FBI warns attackers are using ARTEX for fast multi-sector intrusions
Original title: FBI Warns Hackers Are Weaponizing ARTEX AI Framework to Launch Autonomous Cyberattacks Worldwide
FLASH-20261113-001 says some intrusions reached privileged access in under three hours, with Chinese models common in deployments.
The FBI published FLASH-20261113-001 on November 13 warning that operators have used ARTEX, an autonomous penetration-testing framework, since August 2026. Written in Go, it turns natural-language objectives into commands run by agents that call external models, including Claude, GPT, DeepSeek, GLM, Grok, and Kimi. Reported activity includes web shells, cloud and Active Directory abuse, theft of data on about 67,000 people in South Korea, and compromise of ConnectWise Cloud Backup affecting more than 2,250 tenants. Developer Autumn-27 removed the GitHub repository on October 8; forks and more than 1,600 exposed consoles remain.
Unconfirmed: The advisory does not name victim organizations or attribute operators to a known group.
- Operations since August 2026 span finance, government, defense, technology, healthcare, energy, and telecom.
- Initial access used unsigned SAML assertions, XXE, SSRF, SSTI, SQL injection, and vendor credentials.
- After entry, agents deployed web shells, WISP, vshell, or AdaptixC2 and abused OAuth apps.
- One reported campaign stole personal data on about 67,000 people in South Korea.
- ConnectWise Cloud Backup compromise reached more than 2,250 downstream tenants.
Impact: Privileged access, data theft, and downstream tenant compromise
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup | — |
- 1.Inventory internet-facing systems and restrict Kudu, SCM, and cloud administration endpoints.
- 2.Enforce least privilege on application consent and monitor Entra credential additions.
- 3.Investigate unexpected LLM API traffic and rate-limit sequential portal lookups.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1078 Valid AccountsT1505.003 Server Software Component: Web ShellT1003.006 OS Credential Dumping: DCSyncT1558.003 Steal or Forge Kerberos Tickets: Kerberoasting
- Vendors
- ConnectWise
- Products
- ConnectWise Cloud Backup
- Organizations
- FBI
- Countries
- South Korea
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | xcai.pro | 199.19.95[.]66 through 199.19.95[.]68, and reseller domain xcai[.]pro. The FBI recommends inventorying peripheral internet-faci |
| ipv4 | 199.19.95.66 | . Indicators include ARTEX host 38.244.50[.]120, WISP nodes 199.19.95[.]66 through 199.19.95[.]68, and reseller domain xcai[.]pro. T |
| ipv4 | 199.19.95.68 | TEX host 38.244.50[.]120, WISP nodes 199.19.95[.]66 through 199.19.95[.]68, and reseller domain xcai[.]pro. The FBI recommends inven |
| ipv4 | 38.244.50.120 | han 2,250 downstream tenants. Indicators include ARTEX host 38.244.50[.]120, WISP nodes 199.19.95[.]66 through 199.19.95[.]68, and re |
From the original article
2 min read at gbhackers.com
The FBI has issued FLASH-20261113-001, warning that hackers are weaponizing ARTEX, an autonomous penetration testing framework, to accelerate cyberattacks worldwide. Published November 13, the advisory describes operations observed since August 2026, spanning reconnaissance, exploitation, privilege escalation, and data exfiltration.
By Eswar · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.