FBI Issues Urgent ARTEX Warning Despite GitHub Takedown As 1,600+ Exposed Consoles Found Online

The FBI has warned that cybercriminals and suspected state-linked operators are using ARTEX, an AI-driven penetration-testing framework, to automate attacks against organisations across multiple industries. In a FLASH advisory issued on November 13, 2026, the bureau described campaigns involving financial institutions, government networks, technology companies and other high-value targets.

The warning highlights the speed at which these operations can develop. According to the FBI, some intrusions progressed from initial targeting to privileged access in less than three hours. Researchers have also identified more than 1,600 publicly exposed ARTEX consoles, although that figure does not represent the number of organisations breached or attackers actively operating the framework.

What is ARTEX and how does it help attackers?

ARTEX is an open-source penetration-testing framework released on GitHub on July 26, 2026, under the developer account Autumn-27. It was presented as a tool for authorised security testing, but security researchers subsequently documented its use in malicious operations.

The framework uses large language models (LLMs) to coordinate multiple specialised agents. A central planning agent divides an assigned objective into smaller tasks, while worker agents use available security tools to investigate targets, identify weaknesses and report their findings. ARTEX maintains information about discovered assets and the progress of an assessment, allowing the agents to build on earlier results.

It does not contain its own AI model. Instead, it connects to external services, including OpenAI’s GPT models, Anthropic’s Claude and other providers such as DeepSeek. This gives operators a way to assign objectives in natural language while the framework handles much of the technical work.

For attackers, the advantage is automation. ARTEX can help coordinate reconnaissance, vulnerability testing, credential discovery and other stages of an intrusion, potentially working on several tasks at once. However, it does not independently defeat every security control. Its effectiveness still depends on the systems it can reach, available credentials, exploitable weaknesses and the permissions an attacker can obtain.

Microsoft and CrowdStrike document separate ARTEX campaigns

The first publicly documented activity involving ARTEX emerged in October, although the FBI says malicious actors had been using the framework since at least August 2026.

On October 7, CrowdStrike reported a campaign against South Korean financial organisations that was active from late September to early October. Researchers recovered ARTEX configuration files, AI session histories and other operational material from infrastructure associated with the activity.

The investigation identified attacks involving a loan-progress inquiry service used by financial brokers at one bank and an employee mobile work-support system at another. CrowdStrike assessed that the unidentified operator was likely financially motivated and Chinese-speaking, but did not attribute the activity to a named threat group. The number of affected organisations also remained unconfirmed in its report.

The FBI’s later advisory put the impact of the South Korean financial campaign at approximately 67,000 individuals whose personal information was reportedly exfiltrated. That figure is an FBI-reported estimate, rather than a victim count independently established in CrowdStrike’s public findings.

A separate investigation followed on October 21, when Microsoft linked ARTEX to Storm-0940, a China-state-aligned threat actor. Microsoft said the group used the framework to automate activity against hundreds of organisations and was responsible for the ConnectWise Cloud Backup supply-chain compromise.

The investigation revealed how attackers exploited applications that already held permissions to access Microsoft 365 customer environments. Using compromised application credentials, they could authenticate without requiring an interactive sign-in from an employee.

Microsoft observed reconnaissance, changes to application credentials and attempts to modify privileges through Microsoft Graph. It also documented cases in which attackers reached privileged cloud access in under three hours. The figure describes specific observed intrusions, not the time required for every ARTEX attack.

The ConnectWise investigation also needs careful interpretation. Microsoft documented attempts to sign in to more than 2,250 downstream tenants. It identified follow-on activity in multiple customer environments, but did not establish that all 2,250 tenants were successfully compromised. The distinction matters because an attempted authentication, successful access and confirmed data theft are different outcomes.

CrowdStrike documented another operation on October 29, identifying a separate espionage campaign attributed to VAPOR PANDA. Beginning October 17, the actor used ARTEX against more than 200 organisations across at least 14 countries, targeting government departments, telecommunications providers, defence organisations and other sectors.

CrowdStrike confirmed post-exploitation activity at nine organisations, including the deployment of the BLOODALCHEMY backdoor. Recovered ARTEX transcripts also showed that a human operator remained involved, directing agents and intervening at important decision points.

These investigations demonstrate that ARTEX is being adopted by different operators for different purposes. The South Korean financial campaign was assessed as likely financially motivated, while the Storm-0940 and VAPOR PANDA operations were linked by researchers to China-aligned activity. They should not be treated as one campaign or assumed to share the same operator.

Why 1,600 exposed consoles do not mean 1,600 victims

The FBI’s November 13 advisory says researchers identified more than 1,600 publicly exposed ARTEX console instances in early November. These are management interfaces accessible over the internet, rather than proof that the associated systems have been compromised or are being used to attack victims.

There is an important measurement difference in the underlying research. In its November 5 investigation, Censys reported 1,465 exposed ARTEX hosts as of November 4. It found that approximately 650 of those hosts were concentrated in two groups of similarly configured hosting infrastructure. After accounting for those patterns, Censys estimated roughly 815 distinct-looking deployments.

Censys also found that some ARTEX installations shared infrastructure with other offensive security and command-and-control tools. However, these observations do not establish that every host was malicious. Some installations could have belonged to legitimate security researchers or penetration testers.

The FBI’s figure and Censys’s measurement are therefore not interchangeable. The FBI reports more than 1,600 exposed instances, while Censys provides a dated measurement of 1,465 hosts and a separate estimate after accounting for repeated hosting configurations. The published research does not fully explain the difference.

The original developer’s response also did not end the framework’s availability. On October 8, the Autumn-27 GitHub profile published a statement saying ARTEX was intended for authorised testing within defined scopes and that development would stop, with the project moving to a closed-source model.

The original repository was subsequently removed. However, Censys’s research found archived copies, translations and rebranded versions still circulating. The FBI also identifies community forks and a commercial version called ARTEX PRO. Removing the original repository has therefore not removed the framework from circulation.

What organisations should do after the FBI warning