Anyone hunting for a copy of ARTEX, the open-source AI penetration testing framework that several threat groups have turned on real victims, should be careful where it comes from. Sophos X-Ops says in its new write-up that it now detects a backdoored copy of the ARTEX Docker image, and that the original project has been taken offline by its developer, so mirrors and clones should be treated as untrusted.
ARTEX has been a fixture of threat reporting since its public release in July 2026. Microsoft linked it to the mid-October ConnectWise Cloud Backup compromise, which it attributes to Storm-0940, a group it assesses as China-state aligned, and Google and Mandiant have described other campaigns using it. We have tracked those reports, most recently in AI agent tied to China's Storm-0940 hits software vendors and Google sees AI hacking agents run real break-ins in seconds. What Sophos adds is a view from its own customers.
The same attacks, only louder and faster
Sophos says it has seen activity at a small number of customers consistent with ARTEX or other AI-assisted offensive tooling. The common themes were webshell and SQL Server command execution, credential theft and attempts to move between systems. What gave the agents away was their rhythm: rapid command sequences, repeated attempts with small changes, and structured output markers.
The company's assessment is that the attacks themselves are broadly the same as human-run ones, but the scale, noise and persistence all increase significantly. Across these intrusions its telemetry logged hundreds of protection events.
ARTEX itself is a multi-agent framework written in Go. Planning agents map the target and choose the next step, worker agents run offensive tools and report back, and the framework keeps a graph of the assets and vulnerabilities it finds while trying several breach paths at once. Operators in reported campaigns have connected it to models including DeepSeek, GLM and Grok, and fed it stolen credentials to use against cloud APIs such as Microsoft Graph.
Hunt back to September for these traces
Sophos points to Microsoft's statement that Storm-0940 was using ARTEX as early as September 2026 and recommends hunting back to at least that date. Its indicators include:
- In the cloud: service principal credentials added, or roles assigned, by an application, and application sign-ins with a scripted user agent.
- On hosts: temporary tool and output files named in the pattern i<intentID>[variant]_<purpose>.<ext>, for example i12345_b2[.]ps1, and files or paths beginning with artx, particularly under C:\Windows\Temp.
- Commands carrying execution-check markers such as MARKER123 or ARTX123, especially in bursts of near-identical commands with output written to temporary files.
Sophos has shipped detections including Troj/Bckdr-SDA for the trojanized Docker image and ATK/Artex-A to C, plus firewall and endpoint IPS signatures for network behaviour such as unsigned JWT "alg none" single sign-on bypass attempts and OAuth redirect URI abuse.
Lock down Entra apps and automate the first response
- Audit service principals and enterprise applications in Microsoft Entra ID, remove third-party app consents you no longer use, and review every credential addition and role assignment made since September 2026.
- Apply Conditional Access to workload identities where licensing allows, and alert on scripted application sign-ins and unusual authentication failure rates.
- Script containment, such as disabling a service principal or revoking its credentials, so it runs at machine speed with an analyst confirming afterwards.
- If your own red team uses agentic frameworks, register their infrastructure and tool names with your SOC so authorised activity stands out.
The backdoored image is a reminder that offensive tools get weaponised in both directions. Once a popular project disappears from its official home, the copies that fill the gap are as likely to target the people downloading them as anyone else.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.