CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

ARTEX

tool · tool:artex

Open-source multi-agent LLM penetration-testing framework (Go back end, Next.js front end) that runs a test from reconnaissance to data exfiltration with little human involvement and can use any AI model; used by Storm-0940 (Microsoft, 2026-10-21) and by an unnamed, probably Chinese-speaking and financially motivated actor that Recorded Future tracks as TAG-217 (CrowdStrike, 2026-10-07; Recorded Future, 2026-10-16).

Coverage
2
1 about it · 1 mention · first 2026-10-18 → last 2026-10-22
Latest activity
2026-10-22
Microsoft: Storm-0940 runs the ARTEX agent framework at machine speed; Expel adds an Okta self-registration…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector
Sources cited
11
11 hosts
2026-10-182 appearances2026-10-22

Action items (1)

Do-now tasks recorded on the entries about ARTEX, newest first. Check the date before acting on an older one.

Defender insights

What each entry about ARTEX tells a defender to do, newest first.

2026-10-22NOTABLEMicrosoft: Storm-0940 runs the ARTEX agent framework at machine speed; Expel adds an Okta self-registration technique

Exposure · triage · detection

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

used by

Story timeline

Every entry that names ARTEX, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-10-22ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration
    active-threatsMicrosoft: Storm-0940 runs the ARTEX agent framework at machine speed; Expel adds an Okta self-registration technique
  2. 2026-10-18ConnectWise Cloud Backup (formerly SkyKick): the vendor's Microsoft 365 application credential was used to sign in to customer tenants, with directory-role self-assignments in about 50 tenants and, Huntress reports, added credentials in two
    mentionactive-threatsConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not undo planted access

Hunting pivots

Affected products
Microsoft Entra IDOkta
Tags
ai-abusechina-nexuscloudespionageidentitynation-state
ATT&CK techniques (9 across 8 tactics)

9 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • ReconnaissanceActive Scanning
  • Resource DevelopmentObtain Capabilities: Artificial Intelligence
  • Initial AccessValid Accounts: Cloud Accounts
  • PersistenceValid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials · Account Manipulation: Additional Cloud Roles · Account Manipulation: Device Registration · Create Account: Cloud Account
  • Privilege EscalationValid Accounts: Cloud Accounts · Account Manipulation: Additional Cloud Credentials · Account Manipulation: Additional Cloud Roles · Account Manipulation: Device Registration
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessBrute Force: Password Spraying
  • DiscoveryAccount Discovery: Cloud Account

Reconnaissance TA0043

T1595Active Scanning×1

Adversaries may execute active reconnaissance scans to gather information that can be used during targeting. Active scans are those where the adversary probes victim infrastructure via network traffic, as opposed to other forms of reconnaissance that do not involve direct interaction.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Resource Development TA0042

T1588.007Obtain Capabilities: Artificial Intelligence×1

Adversaries may obtain access to generative artificial intelligence (AI) tools, such as large language models (LLMs), to aid various techniques during targeting. These tools may be used to inform, bolster, and enable a variety of malicious tasks, including creating scripts, assisting social engineering, developing payloads, and to Query Public AI Services in support of Reconnaissance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×1

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.003Account Manipulation: Additional Cloud Roles×1

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1136.003Create Account: Cloud Account×1

Adversaries may create a cloud account to maintain access to victim systems. With a sufficient level of access, such accounts may be used to establish secondary credentialed access that does not require persistent remote access tools to be deployed on the system.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.001Account Manipulation: Additional Cloud Credentials×1

Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.003Account Manipulation: Additional Cloud Roles×1

An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant. For example, adversaries may update IAM policies in cloud-based environments or add a new global administrator in Office 365 environments. With sufficient permissions, a compromised account can gain almost unlimited access to data and settings (including the ability to reset the passwords of other admins).

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

T1098.005Account Manipulation: Device Registration×1

Adversaries may register a device to an adversary-controlled account. Devices may be registered in a multifactor authentication (MFA) system, which handles authentication to the network, or in a device management system, which handles device access and compliance.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Credential Access TA0006

T1110.003Brute Force: Password Spraying×1

Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Discovery TA0007

T1087.004Account Discovery: Cloud Account×1

Adversaries may attempt to get a listing of cloud accounts. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application.

Evidence: 2026-10-22/artex-storm-0940-agentic-llm-pentest-spraying-oauth-abuse · ATT&CK page ↗

Entries about ARTEX (1)

2026-10-22 · view entry permalink →

NOTABLENATOB2

ARTEX: Microsoft reports Storm-0940, a China-state aligned actor, running an open-source multi-agent LLM penetration-testing framework against hundreds of organizations, with privileged cloud access in under three hours in some cases, and Expel sees the same infrastructure abuse Okta self-service registration

Microsoft Threat Intelligence reports that as early as September 2026 Storm-0940, a China-state aligned actor active since 2021, used the agentic penetration-testing framework ARTEX to automate attacks on hundreds of organizations across many industries, government and military among them (Microsoft, 2026-10-21). ARTEX is an open-source multi-agent LLM system that can use any AI model and runs a penetration test from reconnaissance to exfiltration with little human involvement (Microsoft, 2026-10-21). Microsoft says ARTEX accelerated the abuse of compromised applications already granted access to Microsoft 365 tenants (Microsoft, 2026-10-21), and Expel adds that it is not a vulnerability and only speeds up familiar techniques such as password spraying and OAuth-application abuse (Expel, 2026-10-21); most targeting failed, yet several cases went from first targeting to privileged cloud access in under three hours (Microsoft, 2026-10-21). Microsoft assesses the same actor was behind the ConnectWise Cloud Backup application-credential abuse (Microsoft, 2026-10-21).

Expel saw Storm-0940 infrastructure scan a customer and, from 2026-10-13, abuse its Okta self-service registration with no ConnectWise application involved: the attacker created five accounts of its own, enrolled Okta Verify on three of them about a minute after activation, made 50 single sign-on logins with more than 100 OAuth tokens issued and ran a password spray that Okta ThreatInsight blocked (Expel, 2026-10-21). Expel says the shared source address is its only link to Storm-0940, the activity alone does not prove ARTEX was used, and it had not seen the technique reported before (Expel, 2026-10-21). Other actors use it: CrowdStrike analysed an unnamed, probably Chinese-speaking and financially motivated actor that ran ARTEX against South Korean financial institutions from late September (CrowdStrike, 2026-10-07), and Recorded Future, which tracks that activity as TAG-217, says use of ARTEX and other AI penetration-testing tools is not limited to it (Recorded Future, 2026-10-16).

Triage: Python and curl user agents match common legitimate automation, so Expel treats them as supporting evidence only, and a Python user agent on an application that normally calls Microsoft Graph with a .NET SDK is the anomaly (Expel, 2026-10-21).

used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries

including multiple instances where the time from initial targeting to privileged access was less than 3 hours

While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.

Microsoft Threat Intelligence 2026-10-21

Used Okta self-service registration to create five accounts of its own, then enrolled Okta Verify on three of them

The shared IP is our only link to Storm-0940, and this activity alone doesn’t prove ARTEX was used.

ARTEX isn’t a vulnerability, so there’s nothing to patch. It speeds up familiar techniques like password spraying and OAuth app abuse.

Expel 2026-10-21

the threat actor is likely a Chinese speaker and financially motivated

CrowdStrike Counter Adversary Operations 2026-10-07

Builds on: ConnectWise SkyKick app credential used in 162+ Microsoft 365 tenants; disabling it does not…

threat22 Oct 03:45Zmulti-sourceOpen finding →
Sources: Microsoft Threat Intelligence · Expel · CrowdStrike Counter Adversary Operations · Recorded Future Insikt Group

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats2

Source distribution

  • bleepingcomputer.com1 (9%)
  • connectwise.com1 (9%)
  • crowdstrike.com1 (9%)
  • expel.com1 (9%)
  • heise.de1 (9%)
  • huntress.com1 (9%)
  • microsoft.com1 (9%)
  • recordedfuture.com1 (9%)
  • other3 (27%)
All cited sources (11)