Skip to content
NewA calmer, faster ZeroHour
Threat actorhigh

FBI says attackers use ARTEX agents to reach privileged access in hours

Original title: FBI Reveals How Hackers Use ARTEX AI Agents to Gain Privileged Access in Under Three Hours

Cyber Security Newsby Guru Baran ()5 min read1
Read at cybersecuritynews.com
Part of a story covered by 12 sourcesFBI warns ARTEX is automating intrusions; forks and consoles remainMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A November 13 FLASH alert says some intrusions combined stolen credentials, exposed apps, and cloud permissions.

The FBI warned that operators use the open-source ARTEX testing framework to automate network attacks. Agents link external language models to scanning, tool use, and step adjustment with limited human input. Microsoft previously tied ARTEX activity to Storm-0940, which attempted access to more than 2,250 Microsoft 365 tenants. WorkOS reported unauthorized access to a sales application and said production services were unaffected.

Unconfirmed: The under-three-hour timing covers some observed intrusions, and tenant counts measure targeting, not confirmed breaches.

Key facts
  • Google observed automated bursts lasting two to 25 seconds.
  • One agent moved from GitHub searches to Azure Key Vault theft in five minutes.
  • Agents mapped more than 110,000 Active Directory objects.
  • Exposed consoles exceeded 1,600 by early November.
  • Separate South Korean financial attacks affected roughly 67,000 people.
Security assessment · AI, from the article

Impact: Privileged access, web shells, and theft of cloud secrets

What to do
  1. 1.Restrict exposed administration tools and reduce application permissions.
  2. 2.Scan repositories for exposed secrets.
  3. 3.Correlate unusual sign-ins with credential additions, role changes, and rapid API activity.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1199 Trusted RelationshipT1505.003 Web ShellT1195 Supply Chain Compromise
Tags
artexfbistorm-0940cloud-intrusionactive-directoryoauth
Vendors
Microsoft
Products
ARTEXMicrosoft 365ConnectWiseAzure Key Vault
Threat actors
Storm-0940
Victims
WorkOS
Organizations
FBIGoogle
Countries
ChinaSouth Korea

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainxcai.proStorm-3358 campaign, reported active as of November 6, 2026 xcai[.]pro Domain LLM API reseller used in the campaign, not identif
ipv4101.53.80.20access through compromised applications October 15–16, 2026 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.
ipv4103.248.148.845.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 IPv4 addresses Proxy in
ipv4124.155.252.63ications October 15–16, 2026 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.
ipv4144.172.64.128h Korean financial campaign 144.172.64[.]60 144.172.64[.]99 144.172.64[.]128 IPv4 addresses Sign-ins and Microsoft Graph API activity
ipv4144.172.64.60t with an exposed directory South Korean financial campaign 144.172.64[.]60 144.172.64[.]99 144.172.64[.]128 IPv4 addresses Sign-ins
ipv4144.172.64.99d directory South Korean financial campaign 144.172.64[.]60 144.172.64[.]99 144.172.64[.]128 IPv4 addresses Sign-ins and Microsoft Gr
ipv4154.201.79.24615–16, 2026 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.
ipv4178.16.54.129ctive as of November 6, 2026 91.92.240[.]238 85.11.168[.]45 178.16.54[.]129 31.77.229[.]35 IPv4 addresses ARTEX servers Storm-3358 ca
ipv4187.15.88.186ivity in customer environments ConnectWise-related campaign 187.15.88[.]186 187.15.90[.]217 187.15.89[.]186 IPv4 addresses Transient
ipv4187.15.89.186onnectWise-related campaign 187.15.88[.]186 187.15.90[.]217 187.15.89[.]186 IPv4 addresses Transient VPN addresses used for Graph API
ipv4187.15.90.217r environments ConnectWise-related campaign 187.15.88[.]186 187.15.90[.]217 187.15.89[.]186 IPv4 addresses Transient VPN addresses us
ipv4199.19.95.66resses Proxy infrastructure South Korean financial campaign 199.19.95[.]66 199.19.95[.]67 199.19.95[.]68 IPv4 addresses WISP command
ipv4199.19.95.67frastructure South Korean financial campaign 199.19.95[.]66 199.19.95[.]67 199.19.95[.]68 IPv4 addresses WISP command-and-control no
ipv4199.19.95.68uth Korean financial campaign 199.19.95[.]66 199.19.95[.]67 199.19.95[.]68 IPv4 addresses WISP command-and-control nodes Storm-3358
ipv4203.160.133.1721.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 IPv4 addresses Proxy infrastructure South
ipv4205.214.59.31compromised applications October 15–16, 2026 101.53.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.
ipv4209.209.85.38249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 IPv4 addresses Proxy infrastructure South Korean financia
ipv423.158.220.984.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.209.85[.]38 IPv4 a
ipv423.248.249.903.80[.]20 205.214.59[.]31 124.155.252[.]63 154.201.79[.]246 23.248.249[.]90 23.158.220[.]98 103.248.148[.]84 203.160.133[.]172 209.20
ipv431.77.229.35mber 6, 2026 91.92.240[.]238 85.11.168[.]45 178.16.54[.]129 31.77.229[.]35 IPv4 addresses ARTEX servers Storm-3358 campaign, reporte
ipv438.244.50.120ype Reported role or activity Campaign / observation window 38.244.50[.]120 IPv4 address ARTEX host with an exposed directory South K
ipv485.11.167.52Storm-3358 campaign, reported active as of November 6, 2026 85.11.167[.]52 IPv4 address Command-and-control server Storm-3358 campai
ipv485.11.168.45ign, reported active as of November 6, 2026 91.92.240[.]238 85.11.168[.]45 178.16.54[.]129 31.77.229[.]35 IPv4 addresses ARTEX serve
ipv491.92.240.238Storm-3358 campaign, reported active as of November 6, 2026 91.92.240[.]238 85.11.168[.]45 178.16.54[.]129 31.77.229[.]35 IPv4 addres

From the original article

5 min read at cybersecuritynews.com

The FBI has warned that hackers are using ARTEX AI agents to automate network attacks, with some intrusions reaching privileged access in under three hours. Its November 13, 2026, FLASH alert describes how attackers combine stolen credentials, exposed applications, and cloud permissions to shorten the gap between discovery and compromise. ARTEX is an open-source security […]

Cyber Security News

By Guru Baran · cybersecuritynews.com

Read the full article at Cyber Security News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.