ARTEX AI Pentest Tool Explained: What It Is, How It Works, Limits and Risks

Last updated: 11 November 2026

Two months ago, almost nobody outside a small circle of security researchers had heard of ARTEX. Today it is the name that keeps showing up in threat intelligence reports from Microsoft, Google, CrowdStrike, CERT-EU and, closest to home, India’s own CERT-In. ARTEX is an open-source, AI-driven penetration testing framework: you give it a goal in plain language, and a team of AI agents goes off to scan, probe and break into systems on its own. It was built for authorised security testing. It is now being used by state-linked espionage groups and financially motivated criminals against banks, governments and technology companies across at least a dozen countries.

The Indian angle became impossible to ignore on 4 November 2026, when CERT-In issued advisory CIAD-2026-0058 warning non-bank lenders, fintechs, payment aggregators and crypto exchanges about a campaign it calls “Crafty Falcon”, which uses ARTEX alongside other AI attack tools. Two days later, Microsoft published a fresh report on a Cambodia-based group using ARTEX against the financial sector, and on 9 November that report was widely covered in the trade press.

I am writing this explainer because ARTEX is the clearest real-world example so far of something many of us in AI education have been warning about: agentic AI does not only write code and answer emails, it can also run an intrusion at machine speed. In this post I explain what ARTEX is, how it works at a conceptual level, what the reports actually say (including where they disagree), what defenders are doing about it, and what it means for Indian students who want careers in cybersecurity and AI.

Quick summary

• What it is: An open-source, LLM-driven, multi-agent penetration testing and command-and-control (C2) platform. It does not ship its own AI model; operators plug in an external LLM.
• Who built it: Google’s threat intelligence team attributes it to the GitHub user Autumn-27. CrowdStrike, as reported by The Hacker News, says it was developed in China.
• Current status: The original repository was taken down in October 2026 after widespread abuse, but forks keep it circulating, including one called “ScopeWeaver” and a paid “ARTEX PRO”.
• Who is misusing it: China-linked espionage clusters (Microsoft’s Storm-0940 and CrowdStrike’s VAPOR PANDA), a Cambodia-based financial crime cluster (Storm-3358), unattributed groups hitting South Korean banks, and the “Crafty Falcon” actor flagged by CERT-In in India.
• Scale: CrowdStrike counted more than 200 targeted organisations in at least 14 countries in one 11-day campaign. Microsoft saw ARTEX attempt sign-ins to more than 2,250 cloud tenants in another.
• India: CERT-In names ARTEX, PentAGI, Cairn and CyberStrikeAI as tools in an active campaign against Indian BFSI entities, including tiny ₹1 “test” transfers before larger fraudulent ones.
• Reality check: ARTEX is fast and tireless, but also noisy and error-prone. Most of what it exploits is old-fashioned: weak passwords, exposed admin panels, leaked keys and unpatched internet-facing apps.

What is ARTEX, in plain language?

A penetration test (pentest) is an authorised, simulated attack. A company hires testers to break into its own systems so it can fix the weaknesses before real attackers find them. Traditionally this is slow, skilled, human work: reconnaissance, scanning, trying exploits, escalating privileges, writing a report.

ARTEX tries to automate most of that loop with AI agents. CERT-EU describes it as “an open-source, LLM-driven autonomous penetration testing platform”. You set a goal (for example, “assess this company’s internet-facing assets”), define a scope, and the agents use real tools such as Nmap, curl and headless browsers to carry out the work. A web dashboard lets a human watch progress, review findings, and approve or steer actions.

The problem is in that word “scope”. According to CERT-EU, ARTEX relies on configured rules and on the model itself to stay within its authorised targets, and there is no hard technical enforcement. In the hands of a legitimate tester, the scope is a contract. In the hands of an attacker, it is simply a list of victims.

How ARTEX works

I am deliberately keeping this at the architecture level. The aim is to understand the threat, not to provide a recipe. Based on the public reports from Google, Microsoft and CrowdStrike:

1. A coordinating agent plans the job. CrowdStrike describes a main agent with subordinate planner and worker agents sharing a graph of facts, findings and goals. Each engagement is treated as a “task”.
2. Specialised sub-agents do the work. Google’s Threat Intelligence Group (GTIG) says ARTEX has six specialised sub-agents covering different stages of an attack, from reconnaissance to post-exploitation.
3. Any LLM can be the brain. Microsoft describes ARTEX as a framework that “can use any AI model”. In the South Korean bank attacks, the operator mainly used DeepSeek V4.1 Flash, supplemented by Z.ai’s GLM-5.3 and xAI’s Grok 4.6, according to CrowdStrike’s findings as reported by The Hacker News. In the VAPOR PANDA campaign, CrowdStrike saw DeepSeek plus a second commercial model it could not confirm.
4. Standard tooling, machine speed. The agents call ordinary utilities and write custom scripts on the fly. GTIG observed bursts of activity lasting 2 to 25 seconds, and in one case 27 events in 23 seconds.
5. A human is often still in the loop. CrowdStrike saw a human operator steering the agents at key decision points with instructions written in Chinese. Planning agents consumed roughly 1.4 billion input tokens in a single intrusion.

Technically, Microsoft and GTIG both describe ARTEX as written in Go with a Next.js web front end. Microsoft adds that its interface can switch between English, Korean, Mandarin, Spanish and Japanese.

Timeline: from GitHub project to global threat

What the major reports found

Microsoft: Storm-0940 and the ConnectWise compromise

Microsoft describes Storm-0940 as a China-state aligned actor active since 2021. Using ARTEX, it ran password spraying against 327 accounts across eight organisations, generating more than 151,000 failed logons, and ARTEX attempted sign-ins to more than 2,250 tenants. The group then abused stolen ConnectWise application credentials to reach customer cloud environments. Microsoft says privileged cloud access was reached in under three hours in several cases.

CrowdStrike: VAPOR PANDA

CrowdStrike reported that the China-nexus group VAPOR PANDA used ARTEX to target more than 200 organisations in at least 14 countries, including foreign ministries, an interior ministry and telecom operators. Post-exploitation was confirmed at nine organisations. CrowdStrike called the campaign “an escalation in China-nexus use of AI agents”.

Google GTIG and Mandiant

GTIG’s analysis is the most detailed on technique. It describes Active Directory enumeration of more than 110,000 objects, Kerberoasting and credential theft, and webshells planted through abused database logging. It warns of “a paradigm shift towards intrusions occurring at machine speed”. Wiz, cited by GTIG, saw one actor go from a first compromised account to deep access in about four hours, and once in about 15 minutes.

Microsoft: Storm-3358 and the financial sector

On 6 November, Microsoft reported that a Cambodia-based, financially motivated cluster it tracks as Storm-3358 began using ARTEX in October against financial organisations, mainly in Southeast Asia. It exploited server-side request forgery (SSRF) and anonymous file upload flaws, then installed open-source remote access tools.

The India story: CERT-In and “Crafty Falcon”

CERT-In’s advisory CIAD-2026-0058, issued on 4 November 2026 through its financial sector team CSIRT-Fin, updates its 9 October warning. Based on the advisory and coverage by Business Standard, Upstox and Elets, the key points are:

• Tools named: ARTEX, PentAGI (an autonomous multi-agent pentest system), Cairn (an attack search engine) and CyberStrikeAI. One outlet listed only three of these, so the four-tool list is the one to rely on.
• Who is targeted: NBFCs, digital lending platforms, fintech firms, payment aggregators, payment service providers and crypto exchanges. Some headlines say “banks”, but the advisory text focuses on these non-bank BFSI entities.
• How they get in: Exposed testing and staging (UAT) environments that share credentials with production; newly disclosed file-upload and deserialisation flaws in PHP and Node.js apps; reverse-engineered mobile apps used to call payment APIs directly; and IP allow-lists bypassed through shared third-party IP pools.
• How money moves: Micro-value test transfers, as low as ₹1, to new beneficiaries before large unauthorised transfers, plus abuse of merchant settlement APIs and theft of crypto wallet keys.
• Timing: Attacks around weekends, holidays and other low-monitoring periods, and repeat targeting of firms that had only partly fixed issues from the October advisory.

One important nuance: CERT-In has not attributed Crafty Falcon to any country or state sponsor. Some headlines linked the campaign to China, but that link comes from researchers’ reporting on ARTEX’s origin and on other campaigns, not from a CERT-In finding. A tool’s origin and an attacker’s identity are two separate questions.

Limits: what ARTEX is not

It is easy to read these reports and imagine an unstoppable AI super-hacker. The evidence points to something more ordinary, and more fixable.

• It exploits old mistakes. Password spraying, exposed admin consoles, unpatched internet-facing apps, leaked API keys in public GitHub repositories, and shared credentials between test and production. None of these are new. ARTEX finds them faster and at greater scale.
• It is noisy. GTIG documented one case where ARTEX generated 240 log events while planting webshells, and cases where sub-agents overwrote each other’s work. In another intrusion, endpoint protection blocked most lateral movement attempts before defenders cut off the attacker’s server.
• It still needs humans for the hard parts. CrowdStrike’s operator was issuing instructions at decision points. Autonomy here means “fewer humans, working faster”, not “no humans”.
• It is not magic against good controls. MFA, short-lived credentials, segmented networks and EDR on every server consistently appear in the reports as the things that slowed or stopped it.

Where the sources disagree

Because this story is moving quickly, some facts are still unsettled, and I think it is worth being honest about them:

• Open or closed source? Most reports call ARTEX open source. The Hacker News quotes the developer saying the project “will no longer be updated and will be converted to a closed source”. In practice, forks remain in circulation.
• Is VAPOR PANDA the same as Storm-0940? One trade report said VAPOR PANDA is “recently tracked as Storm-0940”, while CrowdStrike’s own report says its campaign is separate from the Storm-0940 activity Microsoft described. Different companies use different names, and mapping them is not settled.
• Who hit the South Korean banks? CrowdStrike said that campaign had not been attributed to any known group, while other reporting linked it to Storm-0940.
• When did it start? Start dates range from late August (GTIG) to September (Microsoft) to 17 October (one CrowdStrike campaign), reflecting different actors rather than a contradiction.

What defenders are doing about it

The defensive advice across Microsoft, Google, CrowdStrike, CERT-EU and CERT-In is strikingly consistent. If you work in or study IT security, these are the controls to understand:

• Shrink the attack surface: Do not expose admin panels, management APIs or staging environments to the internet. Separate non-production from production completely.
• Fix identity first: Enforce MFA, move to short-lived credentials and managed identities, rotate keys after any suspected exposure, and assume any secret pushed to a public repo is already compromised.
• Patch fast where it matters: Prioritise internet-facing apps, especially file-upload and deserialisation flaws, using WAF rules as a temporary shield.
• Watch behaviour, not signatures: Microsoft notes that blocking default user agents “will not stop an attack”. Look for machine-speed patterns: bursts of varied requests, rapid retries, unusual Graph or cloud API activity.
• Use deception: Microsoft, CERT-In and others recommend honeypots, decoy panels and canary credentials. Autonomous agents chase “wins”, and a fake win can waste their time and expose them.
• For payments: CERT-In recommends flagging micro-value transfers to new beneficiaries followed by large ones, cooling periods for new beneficiaries, server-side transaction validation, and signed API requests.

Legal and ethical angle in India

This is general information, not legal advice.

Running a tool like ARTEX, PentAGI or any scanner against systems you do not own or have written permission to test is not “research” or “practice”. Under the Information Technology Act, 2000, unauthorised access and damage to computer systems can attract civil liability (Section 43) and criminal penalties (Section 66). Organisations in India are also required to report cyber incidents to CERT-In within six hours under CERT-In’s April 2022 directions, and the CIAD-2026-0058 advisory asks BFSI entities to report incidents to CERT-In and fraudulent transactions through the I4C reporting portal.

CERT-In’s advisory also tells organisations to prohibit unauthorised offensive AI tools internally and to require written approval, scope and a time window for any penetration test. For students, the rule is simple: practise only on your own machines, deliberately vulnerable labs, and platforms where testing is explicitly permitted.

Why this matters for Indian students and educators

I see two big lessons here, and both are good news for students who build real fundamentals.

First, AI has made attacks cheaper, which makes defenders more valuable. India’s BFSI sector, fintechs and government bodies need people who can read logs, understand identity systems, design secure APIs and respond to incidents. These are exactly the jobs ARTEX is creating demand for: SOC analysts, cloud security engineers, incident responders, and IT officers in banks and PSUs.

Second, every attack in these reports maps to a syllabus topic.

• Computer Networks: scanning, HTTP, SSRF, proxies and tunnels, how firewalls and WAFs work.
• Operating Systems: processes, privileges, privilege escalation and why least privilege matters.
• DBMS: SQL injection, database logging and why credentials should never sit in tables or code.
• Information Security and Cryptography: authentication, Kerberos, tokens, key management, signed requests.
• Machine Learning and AI (GATE DA): how LLM agents plan, call tools and fail; why “the model will stay in scope” is not a security control.
• Software Engineering: secure SDLC, secret scanning, separating staging from production.

If you are preparing for bank IT officer exams, note that CERT-In advisories, IT Act provisions and BFSI security practices are fair game in professional knowledge sections. If you are an educator, ARTEX is an excellent case study for a class discussion on dual-use AI: the same agent that helps a red team find bugs before release can help a criminal find them first.

My suggested learning path: get comfortable with Linux and networking basics, learn how authentication and cloud identity work, practise on legal labs and capture-the-flag challenges, and then study how AI agents use tools. Understanding both sides is where the career advantage lies.

Frequently asked questions

What is ARTEX in cybersecurity?

ARTEX is an open-source, AI-driven, multi-agent framework for automated penetration testing. It uses external large language models to plan and carry out reconnaissance and attacks within a goal set by an operator. It has been widely abused by threat actors since late August 2026.

Is ARTEX illegal to use?

The software itself is a dual-use security tool. Using it, or any similar tool, against systems without the owner’s written authorisation can be an offence under India’s IT Act and similar laws elsewhere. CERT-In has also advised organisations to ban unauthorised offensive AI tools.

Which AI models does ARTEX use?

It does not include its own model. In reported attacks, operators used DeepSeek V4.1 Flash, Z.ai GLM-5.3, xAI Grok 4.6 and at least one unidentified commercial model.

Did ARTEX attack Indian banks?

CERT-In’s 4 November 2026 advisory says the “Crafty Falcon” campaign uses ARTEX and other AI tools against Indian NBFCs, fintechs, digital lenders, payment aggregators and crypto exchanges. The advisory does not name individual victims and does not attribute the campaign to any country.

How can organisations defend against AI-driven attacks like ARTEX?

Reduce internet exposure of admin and staging systems, enforce MFA and short-lived credentials, patch internet-facing apps quickly, monitor for machine-speed behaviour, deploy EDR everywhere, and use deception such as honeypots and canary credentials.

Should students download ARTEX to learn?

I would not. The original repository is gone, and unofficial forks and paid variants are of unknown origin and could themselves be malicious. Learn the concepts with well-known, legitimate tools inside isolated labs you control.

The bottom line

ARTEX is not a science-fiction AI hacker. It is an automation layer that lets a small team, or even a single operator, run many attacks in parallel at machine speed, using whatever AI model they can get access to. What it exploits is mostly familiar: exposed systems, weak identity controls, leaked keys and slow patching. That is both the worrying part and the hopeful part. The worrying part is that the cost of attacking has dropped sharply, and Indian fintechs are already in the firing line. The hopeful part is that the fixes are known, and the people who can implement them are the students learning networks, operating systems, databases and AI fundamentals today.

Sources and further reading

• CERT-In Advisory CIAD-2026-0058: AI-driven attacks on BFSI entities by “Crafty Falcon”
• Google Threat Intelligence Group: ARTEX and Friends, Enter Agentic Offensive Frameworks
• Microsoft: AI-driven nation-state campaign using ARTEX enables supply chain compromise
• Microsoft: ARTEX abuse expands as cybercriminals target financial sector
• CrowdStrike: VAPOR PANDA uses AI-driven ARTEX to scale a global espionage campaign
• CERT-EU: From Penetration Testing to Cyber Threat, Beware of ARTEX
• The Hacker News: ARTEX used in data theft attacks on South Korean financial firms
• SecurityWeek: China APT uses AI pentest tool Artex in ConnectWise attacks
• Cybersecurity Dive: Agentic pen-testing tool employed in multiple espionage campaigns
• Cybersecurity Dive: Financially motivated threat cluster uses AI-enabled tools against banking sector
• Cybersecurity Dive: Hackers enlist Artex to scan GitHub repositories for exposed secrets
• Business Standard: CERT-In warns banks, fintech firms of AI-driven fund transfer fraud
• Upstox News: Why CERT-In has sounded an alarm over AI-powered cyberattacks on NBFCs, fintechs

Written by Piyush Wairale (M.Tech, IIT Madras), founder of PiyushAI Edtech. This is a fast-moving story; figures, attributions and advisory details are as reported on or before 11 November 2026.