Foreword
In recent weeks, CERT-EU has observed several threat actors around the world that have used ARTEX, an AI-powered penetration-testing framework, to automate their campaigns. ARTEX rapidly identifies and exploits misconfigurations in addition to targeting traditional software vulnerabilities.
CERT-EU has observed similar instances of AI-driven activities against its constituency. These activities highly likely involved the use of ARTEX.
We assess that ARTEX's public availability will likely accelerate adoption by threat actors, resulting in more frequent, faster, and scalable automated attacks with a higher success rate. CERT-EU is publishing this blog post to raise awareness of the widespread use of ARTEX by threat actors.
What is Artex
ARTEX is an open-source, LLM-driven autonomous penetration testing platform. It takes a security objective in natural language, decomposes it into goals and intents, and then has one or more agent workers execute reconnaissance and testing steps autonomously, within a scope defined by the operator, using real tooling rather than simulated actions.
It is designed to be observed and steered by a human operator through a dashboard covering task orchestration, traffic recording, findings, coverage and an approval queue. The tool relies on configurable rules and the model itself to respect scope and avoid destructive actions; there is no hard technical enforcement.
Following reports of misuse, the original author made the repository unavailable in October 2026. The publicly available versions are now independent forks rather than an official upstream release. ARTEX does not include its own AI model; it integrates with external LLM providers, and operators supply a compatible model of their choosing. Integrations and capabilities may differ between forks.
Its relevance to us lies in its scale, speed and persistence. ARTEX can test large numbers of low-complexity misconfigurations, including those a human tester would notice but not have time to check, and it can work through long attack chains without the fatigue that limits manual testing. The same is true of complex payload crafting. Exploitation paths that need carefully tailored payloads often take more effort than the severity of the finding justifies, so a manual assessment may leave them untested.
Tactics, Techniques and Procedures (TTPs)
| ATT&CK ID | Technique |
|---|---|
| T1595 | Active Scanning procedure |
| T1588.002 | Obtain Capabilities: Tool |
| T1190 | Exploit Public-Facing Application |
What you can do
Immediate
- Identify internet-exposed IT assets and limit internet exposure to only those assets that require it.
- Ensure management and control panels are isolated from internet or from unsecure networks.
- Prioritise emergency patching for all internet-exposed assets.
- Closely monitor privileged and administrator account activity to detect anomalous behaviour, unauthorised actions, and potential abuse of elevated privileges.
Short-Term
- Implement Multi-Factor Authentication (MFA) across all critical systems and services to protect against account takeover and unauthorised access.
- Hunt for and alert on connections to known or suspected actor infrastructure to identify potential targeting or compromise. Hunt for artefacts and behaviours consistent with ARTEX usage (e.g. automated scanning patterns, specific tool signatures) in your organisation's logging.
- Use Endpoint Detection and Response (EDR) tools to monitor and block processes exhibiting unusual behaviour, such as privilege escalation attempts.
Continuously
- Sanitise error responses from internet-facing devices to minimise information disclosure and hinder adversary fingerprinting and identification of underlying technologies and infrastructure.
- Protect internet-exposed assets with a web application firewall (WAF) or equivalent security solution.
- Prioritise implementation of detection and logging good practices for internet-exposed assets to support security monitoring and incident response.
- Ensure security monitoring also covers AI tools and internet-connected assets that use AI processes.
- Assess the security of your internet-facing devices with regular vulnerabilities scans, penetration tests, and using trusted AI-assisted cybersecurity tools and frameworks.
- Retain all findings, including non-severe ones, in the remediation cycle to prevent AI-enabled tooling from chaining minor misconfigurations into higher-impact attack paths.
References
- https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks
- https://www.zscaler.com/blogs/security-research/inside-global-ai-assisted-hacking-campaign
- https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
- https://www.khan.co.kr/en/article/202610042320007
- https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/
- https://www.yna.co.kr/view/AKR20261026075100004
- https://www.japantimes.co.jp/news/2026/10/20/japan/china-ai-cyberattacks/
About CERT-EU
CERT-EU is the Cybersecurity Service for the Union institutions, bodies, offices and agencies, established under Regulation (EU, Euratom) 2023/2841. Under the Cybersecurity Regulation, CERT-EU acts as the central cybersecurity hub for all Union entities, providing threat intelligence, incident response coordination, vulnerability management, and security guidance. CERT-EU also supports Union entities in implementing their cybersecurity risk-management frameworks and issues calls for action to raise the collective level of cybersecurity across the EU institutional ecosystem.
CERT-EU is a member of the CSIRTs Network, the network of national Computer Security Incident Response Teams established under the NIS2 Directive (Directive (EU) 2022/2555). The CSIRTs Network facilitates operational cooperation and the exchange of cybersecurity information between EU Member States and Union entities, enabling coordinated responses to cross-border cyber incidents.
CERT-EU also maintains a structured cooperation with ENISA, the European Union Agency for Cybersecurity, as provided for under Regulation (EU) 2019/881 (the Cybersecurity Act). This cooperation covers areas such as cyber threat analysis and the sharing of threat landscape assessments.