Research

Off the Rack: A Free AI Attack Framework Is Now in Three Unrelated Hands. CrowdStrike Says One Operator Used It on 200+ Organizations, and Every Way In Was Old.

Patrick Duggan · · 6 min read

Off the Rack: A Free AI Attack Framework Is Now in Three Unrelated Hands. CrowdStrike Says One Operator Used It on 200+ Organizations, and Every Way In Was Old.

ARTEX is a free, open-source framework that coordinates AI agents to run a penetration test from reconnaissance through data theft, and it works with whatever language model you point it at. In four weeks, two vendors have described it in three unrelated hands. CrowdStrike's October 29 report says one operator, a group it tracks as VAPOR PANDA, directed it against more than 200 organizations in 14 countries over 11 days. Nothing in how the agents got in was new.

A graph of ARTEX at the center with three operators attached by solid lines: Storm-0940 reported by Microsoft on October 21, VAPOR PANDA reported by CrowdStrike on October 29, and an unattributed financially motivated operator targeting South Korean finance reported by CrowdStrike on October 7. n0n and Chainalysis are attached by dashed lines because no evidence links them to ARTEX. A strip lists the old holes the agents used: an app secret, keys not rotated since 2022, LAPS passwords, VPN configurations from sent mail, an unsigned SAML assertion with XXE, and a request to find machines without the endpoint sensor. A timeline runs from late September to October 30.

Three operators, one tool

  • An unattributed operator, South Korean finance (CrowdStrike, October 7). Activity from late September into early October. CrowdStrike assesses with moderate confidence that the operator speaks Chinese and is financially motivated.
  • Storm-0940 (Microsoft, October 21). Microsoft describes a China state-aligned group and ties it to the ConnectWise Cloud Backup compromise. We covered that last week. Microsoft says the group attempted sign-ins at more than 2,250 tenants. Those were attempts, not compromises.
  • VAPOR PANDA (CrowdStrike, October 29). A China-based group CrowdStrike previously tracked as VexatiousTemper. CrowdStrike says this is its first observed use of AI tooling.

CrowdStrike says the Storm-0940 activity and VAPOR PANDA's are separate. It reads the two reports together as a sign that the framework is spreading among several China-nexus groups. The developer reportedly said on October 8 that the project would stop being updated and go closed source, according to The Record citing the Wall Street Journal, which is after the first public report and before the other two.

What VAPOR PANDA did, per CrowdStrike

  • Scale. More than 200 organizations targeted. Post-exploitation confirmed at nine. Password spraying and credential scanning against at least 12 more. So 200 is a target count, not a victim count.
  • Targets. Foreign ministries, an interior ministry, defense, justice, finance, pharmaceutical, semiconductor, nuclear and telecom organizations in the United States, Europe, Asia, the Middle East and Latin America.
  • How it ran. ARTEX on DeepSeek, plus a subscription commercial model CrowdStrike could not identify. A main agent directs planner and worker agents that share a graph of findings. One human operator ran several engagements at once, typing instructions in Chinese at decision points. CrowdStrike estimates the planning agents in one intrusion used about 1.4 billion input tokens.
  • The malware. BLOODALCHEMY, which CrowdStrike says was first publicly documented in October 2023, delivered by sideloading a loader through a renamed game-overlay program.

Every way in was old

These are the access paths CrowdStrike describes. None needed a new vulnerability in the usual sense, and several needed none at all.

  1. An unsigned SAML assertion chained with an XML external entity flaw to query the cloud instance metadata service at a U.S. pharmaceutical company. That returned a role able to run commands on thousands of instances, and from there an enterprise administrator account.
  2. A web shell and an unauthenticated orchestration service gave root in a production container environment at a second pharmaceutical company. The agent then read LAPS passwords and abused resource-based constrained delegation.
  3. Authentication keys that likely were never rotated after a 2022 export from a mail server at a Greek government entity. The agent forged an administrator token and read mailboxes.
  4. VPN configurations pulled from a user's sent mail, plus a VPN client key the operator said came from a May 2024 email leak.
  5. Password spraying against at least a dozen more.

One more detail matters for anyone who runs endpoint security. At a global pharmaceutical company the operator told the agents to find Windows machines in the domain without the Falcon sensor, judging by process lists and folder listings. CrowdStrike's own post describes evading CrowdStrike's own sensor, so read its emphasis on coverage with that in mind, but the instruction is the point: the agents were asked to find the hosts nobody is watching.

Nothing here is bespoke

Compare this with the Ivanti Connect Secure chain we covered this morning: three flaws chained into root on a patched appliance, exploited before a fix existed. That is custom work.

ARTEX is the opposite. The tool is free. The model is a commodity, reached in one case through an API reseller. The malware has been public for three years. The holes are keys nobody rotated, passwords nobody locked down and configuration files sent in email. What the agents add is speed and scale, one operator working many targets at once, not a new way in. That also explains why the group is hard to pin down. A tool anyone can download fingerprints an ecosystem, not an operator, which is the same lesson as the misspelled scanner user agent we wrote up earlier today.

What to do

CrowdStrike's recommendations, with a few of ours marked.

  1. Rotate signing keys, pre-authentication keys and service credentials after any suspected exposure, including in old backups and exports. The 2022 export is the case.
  2. Enforce SAML signature validation, so an unsigned assertion is rejected.
  3. Require version 2 of the instance metadata service and limit what cloud roles may run on which instances.
  4. Hunt for ARTEX markers: command-line parameters containing "artx" or "artex," cloud roles whose names start with "artx," "art18-" comments in administration commands, and an "artx5v" folder under ProgramData.
  5. Patch internet-facing appliances, especially long-lived Linux servers, and put real-time endpoint detection on servers with no internet access too.
  6. Ours: list the hosts that have no sensor, before an attacker does. If you cannot produce that list in an afternoon, the agents can.
  7. Ours: stop emailing VPN configurations and key files, and check who can read LAPS passwords.

Indicators

From CrowdStrike's October 29 report. Domains are written with brackets so nothing here is a live link.

The Claude detail

CrowdStrike's October 7 report on the South Korean operator found open directories holding that operator's Claude Code session histories, ARTEX configuration files and Claude memory files. The sessions included questions about where Korean breach data is typically sold and for help finding Korean Telegram groups that sell it, and a request to draft a researcher résumé. The report also says the operator supplemented DeepSeek with two other commercial models.

The report does not say whether Claude answered or refused, how the operator got access, or whether any model provider was told. We build with Claude, so weigh our reading of that section accordingly, and read the original before drawing a conclusion from it.

What we hold and what we did

We ingested eight indicators from the CrowdStrike report: the three domains, the three addresses and the two hashes above, scored 85 for domains and hashes and 80 for addresses because the hosting may be shared. Each record cites CrowdStrike and says it is their research, not our observation. We hold the South Korea operator's ten addresses too, since October 12, from CrowdStrike's October 7 report. Ingest time is not detection time, so none of this is a lead: both sets are corroboration of CrowdStrike's work.

We left out two things on purpose. The renamed game-overlay program's hash may belong to a legitimate program that was abused, and a block list that catches it would hit innocent software. The API reseller named in the South Korea report likely serves other customers.

Across about 46,000 edge blocks, 49,000 canary records and 1,800 origin records since September 15, we saw no traffic from the three command-and-control addresses. That is a measurement of our own edge only, and it says nothing about yours.

Limits

We read the CrowdStrike and Microsoft posts through a text extractor, not in full, so a detail could be missed, and counts differ across outlets. We did not fetch or probe any host named here. Whether Chainalysis or n0n have any connection to ARTEX is unknown, and nothing we read links them. The comparison to the Ivanti chain and the "off the rack" reading are our interpretation, not a finding by either vendor.

Five percent of this is wrong somewhere. It always is.

Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register