The FBI wants companies to look hardest at the systems they watch least. In a FLASH alert released Friday, the bureau said threat actors have turned ARTEX, an open-source AI agent framework built for penetration testing, into a way to “automate multiple phases of cyber intrusions at machine speed, from reconnaissance through data exfiltration.” It singled out partner and supplier portals, mobile backends, sales-support systems, legacy services and third-party integrations as the places the tool excels at breaking into.
Some ARTEX-driven intrusions went from initial targeting to privileged access in under three hours, the FBI said. A variety of malicious actors have used the framework since at least August against organizations in financial services, government, technology, defense, semiconductors, energy, healthcare, manufacturing, telecommunications and legal. The alert says ARTEX generates high volumes of noisy traffic that may trigger alerts, but the speed of the attacks leaves “limited time for coordinated defender response before objective completion.”
ARTEX is written in Go. It takes goals written in plain language and turns them into commands carried out by specialized agents, with little human involvement once the objective is set. It has no model of its own and plugs into outside ones, from Anthropic’s Claude and OpenAI’s GPT to open-source and Chinese-origin models such as DeepSeek, GLM and Kimi. The FBI says analysis of attacker-controlled instances shows Chinese models were the most common, and DeepSeek’s Flash family dominated “due to their balance of capabilities, relatively low cost, and lack of observable guardrails when framed for penetration testing.”
Internet-scanning firm Censys, whose research the bureau cites, laid out the mechanics earlier this month. A planner agent breaks the goal into attack “intents.” Worker agents claim those intents, run tools such as nmap and write the results back, and the loop repeats until the goal is met.
A pentest tool that outlived its own takedown
ARTEX first appeared on GitHub in July. Its developer said the tool was meant for authorized testing within defined scopes and made the repository unavailable on Oct. 8, after reports that attackers were using it. The FBI says that hasn’t contained it. Community forks, localized variations, archived copies and a commercial version called ARTEX PRO keep it in circulation. Censys counted 1,465 hosts exposing an ARTEX console as of Nov. 4, about 650 of them in two blocks of identically configured hosting, which leaves roughly 815 distinct-looking deployments. It noted the console doesn’t need to face the internet at all, so total deployments are likely higher. The FBI’s alert, which cites Censys’s report, puts the number of exposed consoles at more than 1,600 as of early November.
The alert pulls together campaigns that security vendors have documented since early October. Microsoft attributed the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, which it describes as a China-state-aligned actor, and said the group used ARTEX to speed up scanning, password spraying and abuse of OAuth applications. The FBI says that compromise enabled access to more than 2,250 downstream tenants. Microsoft’s own account says the group used ARTEX to attempt sign-ins to more than 2,250 tenants, and that an affected application or even a successful sign-in does not necessarily mean customer data was accessed. As WebProNews reported in October, the sweep also reached tenants that no longer used the backup service. A separate, financially motivated campaign against South Korean financial institutions exfiltrated personal information on about 67,000 people, the bureau said.
CrowdStrike has tracked some of the largest operations. The company said a group it calls Vapor Panda ran ARTEX primarily with DeepSeek against more than 200 organizations in at least 14 countries starting Oct. 17, and it confirmed post-exploitation activity at nine of them. In a single intrusion, the group’s planning agents consumed “on the order of 1.4 billion input tokens,” CrowdStrike said.
Amazon added its own findings Friday. Its MadPot decoy sensors, configured to look like popular LLM inference APIs, caught ARTEX agents sending along their own campaign records between Oct. 3 and Nov. 5. The most prominent campaign Amazon described was large-scale theft of credentials for AI models, “organized as a self-sustaining operation in which stolen keys paid for the LLM inference powering further credential hunting.” AI is speeding up flaw discovery as well. VulnCheck says AI-driven bug hunting is behind most of the more than 100,000 CVEs published so far this year.
Where the FBI wants defenders to start
The FBI’s tactics table lists the entry points ARTEX agents have used. They include unsigned SAML assertions, XXE and SSRF flaws, hard-coded administrator passwords in single-page-app JavaScript bundles, web APIs with no authentication, weak admin credentials and stolen VPN configurations. The post-access activity it lists includes enumerating more than 110,000 Active Directory objects and taking inventory of which Windows machines lacked endpoint sensor coverage.
The bureau’s first recommendation is an inventory of every internet-facing application, including the ones built by individual business units. It wants cloud administration, network device management, Kudu/SCM publishing endpoints, hypervisors and backup platforms reachable only from trusted networks or dedicated admin paths. It also calls for least privilege on multi-tenant app permissions and consent grants, monitoring of credential additions to applications, rate limits on high-impact business APIs, and continuous scanning of code repositories, container images and CI/CD pipelines for exposed secrets. On partner and employee portals, it recommends alerts on sequential lookups and on unusually high numbers of records pulled in a single session.
The indicator list runs to 24 IP addresses and one domain, an LLM API reseller tied to the South Korea campaign. The FBI cautions that cloud addresses get reassigned and should be vetted before anyone blocks them. Its behavioral indicators include high-frequency sequential requests against login and search endpoints, web shells in unexpected application paths, and unexpected outbound calls to commercial model APIs alongside other suspicious activity. Organizations reporting incidents are asked to include LLM API billing anomalies and any evidence of self-hosted model gateways or reseller software.
For ConnectWise customers, the alert is specific. The FBI says to review every Microsoft 365 tenant where the affected applications were ever installed or authorized, searching by application ID rather than display name, and to keep those connections disabled until ConnectWise provides formal restoration instructions.
WebProNews is an iEntry Publication