Executive Summary
ARTEX is an agentic, LLM-driven autonomous penetration testing framework released in July 2026 that has been rapidly adopted by both financially motivated and state-aligned threat actors. Originally an open-source project by developer Autumn-27, it has been observed in campaigns targeting South Korean financial institutions and in a major supply-chain compromise of ConnectWise Cloud Backup tenants by the China-aligned group Storm-0940. As of November 2026, Censys has identified over 1,460 exposed ARTEX instances globally, with significant clusters in the US, Hong Kong, and China.
Technical analysis reveals that ARTEX functions as an AI agent layer on top of the ScopeSentry recon platform, using LLM 'Planners' to generate attack intents and 'Workers' to execute tools like nmap. Notable for its speed, the framework enabled Storm-0940 to achieve privileged cloud access in under three hours in some instances. Many operators demonstrate poor operational security, frequently leaving open directories that expose post-exploitation kits, lateral movement scripts, and session histories, providing defenders with critical insights into active campaigns.