Storm-0940
Threat actorRecent news
ARTEX AI framework used by state-linked and criminal hackers to automate enterprise attacks
ARTEX is a multi-agent AI penetration-testing framework that can plan and run reconnaissance, exploitation and post-compromise steps, reviewing tool output and adjusting its next action. Google Threat Intelligence Group and Mandiant reported its use in Active Directory attacks, privilege escalation, cloud reconnaissance, lateral movement and exfiltration preparation, Microsoft linked it to Storm-0940, and CrowdStrike tied it to VAPOR PANDA, which targeted more than 200 organisations. The article stresses that the main risk is how quickly existing weaknesses, such as stolen passwords and excessive permissions, can be found and chained together.
China-linked groups use AI agents to probe enterprise defences in global campaigns
CrowdStrike reported that VAPOR PANDA used the AI pentesting framework ARTEX against more than 200 organisations over 11 days from October 17, with post-exploitation confirmed at nine. Attackers used AI agents to check whether Falcon sensors were installed, reused unrotated authentication keys, and combined an unsigned SAML assertion with an XXE flaw to gain administrative cloud access. Akshat Tyagi of HFS Research said CISOs should monitor their whole environment, rotate credentials and prepare for faster automated intrusions.
Attackers use open-source ARTEX AI agent to automate Active Directory attacks
ARTEX, an open-source multi-agent penetration testing and command-and-control platform written in Go, is being abused to automate Active Directory attacks, including Kerberoasting, DCSync and lateral movement. Google's Threat Intelligence Group and Mandiant have seen it used since late August 2026 against organisations in several sectors, and Microsoft has linked it to a China-linked group targeting Microsoft 365 tenants. Google says it trades stealth for speed, so defenders can still detect it through its noisy logs and artefacts.