Research

The FBI's ARTEX Warning Adds a Second Criminal Crew Hitting Banks, Azure Kudu Abuse and 22 Addresses. Here Is What Is New Since Our Last Two Posts.

Patrick Duggan · · 6 min read

The FBI's ARTEX Warning Adds a Second Criminal Crew Hitting Banks, Azure Kudu Abuse and 22 Addresses. Here Is What Is New Since Our Last Two Posts.

If you run web apps on Azure App Service, lock down the Kudu (SCM) endpoint and turn off basic publishing authentication this week. The FBI's new ARTEX advisory lists Kudu abuse as a way the AI agents ran commands and kept access, and it asks you to restrict those endpoints to trusted networks. Then search your egress logs for the 22 addresses below, and for traffic to webhook.site and api.db-ip.com from servers that should never call them.

The FBI published FLASH-20261113-001, "Threat Overview of ARTEX Autonomous Penetration Testing Framework," on November 13. It is 13 pages, marked TLP:CLEAR, and carries only the FBI's name. We found no joint CISA advisory. We have written about ARTEX twice already: CrowdStrike's VAPOR PANDA report and the old holes it used on October 31, and the backdoored Docker image and the 62 consoles serving it on November 5. This post covers only what the FBI adds.

What is new

A start date. The FBI says criminals and state actors have used ARTEX since at least August 2026. Our earlier posts started the clock at late September.

A second criminal crew. The FLASH carries eight addresses from a Microsoft report of November 6 about a group Microsoft calls Storm-3358. We had not covered it. Microsoft describes Storm-3358 as a financially motivated cluster based in Cambodia that began using ARTEX against financial organizations in October, mostly in Southeast Asia, plus a smaller number of large financial firms elsewhere. Microsoft gives no victim count. It says the group got in through anonymous file upload and server-side request forgery, then had the agents pull down three open-source remote access tools, WISP, vshell and AdaptixC2, with netcat and curl.

A wider sector list. The FBI names financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications and legal. Energy, manufacturing and legal did not appear in the reports we covered.

Cloud techniques we had not described. From the FBI's table of observed activity:

  • Mapping what stolen Azure credentials can do (SAS tokens, service principals, Kudu credentials, storage account keys) with sub-second checks, test blob writes and deletes, and deployment validation dry runs.
  • Running commands through Kudu administrative APIs.
  • Pulling hardcoded administrator passwords out of single-page-app JavaScript bundles.
  • Web shells planted through MySQL log poisoning.
  • Modifying iOS app distribution infrastructure with exposed cloud credentials, which the FBI cites as a supply chain case.
  • Launching cloud instances with high-value roles, allocating Elastic IPs, creating 100 GB volumes to stage data.
  • DCSync to take the domain krbtgt key, and enumeration of more than 110,000 Active Directory objects in one intrusion.
  • Sending command output to rotating webhook.site endpoints and looking up victim location at api.db-ip.com.
  • Tunneling through Chisel and SoftEther, and routing through residential proxies and Tor.

The models. The FBI says analysis of attacker-run ARTEX instances shows Chinese models are most common, with DeepSeek's Flash family dominating because it is cheap and, framed as a penetration test, shows no observable guardrails. ARTEX also works with Claude, GPT, GLM, Grok and Kimi. We build with Claude, so read our take on that with the bias in mind.

A commercial edition. The FBI says a paid version called ARTEX PRO is circulating alongside forks and archived copies.

One new domain. xcai[.]pro, which CrowdStrike identified as the LLM API reseller in the South Korean finance case. We left it out of our feed on October 31 because a reseller likely serves people who are not attackers. We still hold no record of it. Treat a connection to it as a reason to look, not a verdict.

What to do

From the FBI's recommendations, in the order we would do them:

  1. Inventory every internet-facing app, including partner and supplier portals, mobile backends, employee apps, sales-support systems and legacy services. The FBI says ARTEX does best against the systems nobody watches.
  2. Restrict cloud admin and publishing endpoints (Kudu/SCM, hypervisors, backup platforms) to trusted networks or private paths. Disable basic publishing authentication where you do not need it. Consider run-from-package so deployed files cannot be edited in place.
  3. Scan for secrets in app configuration, environment variables, infrastructure code, pipelines, container images and JavaScript bundles, and rotate what you find.
  4. Rate-limit the APIs that matter, and alert on sequential lookups or unusually many records per session on partner and employee portals.
  5. Stop returning stack traces, SQL errors and internal paths to unauthenticated users.
  6. Watch egress for LLM traffic that should not be there: api.anthropic.com, api.deepseek.com, open.bigmodel.cn and api.x.ai from servers, and self-hosted gateways such as CLIProxyAPI or New API. The FBI frames these as things to investigate alongside other signals, not to block. Your developers may call the same endpoints.
  7. If you ever authorized a ConnectWise app, the October advice stands: search by application ID, keep it disabled, preserve logs from October 1.

Indicators

From the FBI FLASH, which credits each to the vendor named. The FBI says the addresses are historical and may since have been reassigned to legitimate services, so check them against current telemetry before blocking. Written with brackets so nothing here is a live link.

  • ARTEX host and open directory, South Korean finance case (CrowdStrike, Censys): 38.244.50[.]120
  • ConnectWise campaign, sign-ins and Graph activity (Microsoft, Storm-0940): 144.172.64[.]60, 144.172.64[.]99, 144.172.64[.]128
  • Graph access through compromised apps, transient VPN addresses relevant October 15 and 16 (Microsoft): 187.15.88[.]186, 187.15.90[.]217, 187.15.89[.]186
  • Proxy addresses, South Korean finance case (CrowdStrike): 101.53.80[.]20, 205.214.59[.]31, 124.155.252[.]63, 154.201.79[.]246, 23.248.249[.]90, 23.158.220[.]98, 103.248.148[.]84, 203.160.133[.]172, 209.209.85[.]38
  • Storm-3358 WISP command-and-control, active as of November 6 (Microsoft): 199.19.95[.]66, 199.19.95[.]67, 199.19.95[.]68
  • Storm-3358 ARTEX servers, active as of November 6 (Microsoft): 91.92.240[.]238, 85.11.168[.]45, 178.16.54[.]129, 31.77.229[.]35
  • Storm-3358 command-and-control server, active as of November 6 (Microsoft): 85.11.167[.]52
  • Domain: xcai[.]pro (LLM API reseller, see above)

Microsoft's own Sentinel hunting query writes the third Storm-3358 server as 178.15.54.129, one digit off its table. The FBI uses 178.16.54.129. We think the query has the typo, but neither source says so.

The FLASH lists no file hashes, no CVEs and no BLOODALCHEMY domains, though it names BLOODALCHEMY. The hashes and domains for that malware are in our October 31 post.

What we hold

All 22 addresses are in our index. The domain is not. None of the 22 is our own observation: every record entered our index from someone else's published research, so ingest time here is not detection time and none of this is a lead.

  • The South Korea host and its nine proxies came in on October 12 from CrowdStrike's October 7 report.
  • The three ConnectWise addresses came in on October 17 and 19 from ConnectWise, Huntress and other public reporting, and were tagged Storm-0940 on October 23 after Microsoft's attribution.
  • The three transient VPN addresses came in on October 21 from Microsoft's Storm-0940 post, at a lower score, since VPN exits are shared.
  • The eight Storm-3358 addresses came in on November 7, the day after Microsoft published, through our automated reading of Microsoft's security blog. They are not yet tagged with the actor name.

Not every one of these ships in the default ips.csv pull today. That file is weighted to recent and higher-confidence records, so if you want the full set, take it from the list above.

We also checked our own edge for the nine addresses that point at attacker-run infrastructure: the eight Storm-3358 addresses and the South Korea ARTEX host. Since September 15, across about 442,000 edge blocks, 98,000 canary records and 2,300 origin records, none of the nine appeared. That measures our own sites only and says nothing about yours. We did not check the proxies or the VPN addresses, which by their nature carry other people's traffic too.

What is not known

How many organizations the FBI counts as victims. The FLASH repeats vendor figures (67,000 people's data in the South Korean case, more than 2,250 tenants reached in the ConnectWise case, more than 1,600 exposed consoles in early November) and adds no tally of its own. BleepingComputer's figures of 162 compromised tenants, seven arrests and 8.2 million records come from its own earlier reporting, not from the FLASH. Who sells ARTEX PRO, and what it adds. Which initial-access flaws, if any, carry CVE numbers; the FLASH names none. Whether the 22 addresses are still in attacker hands.

How we know

We read the FBI FLASH in full from the PDF on ic3.gov, extracted to text, and Microsoft's November 6 Storm-3358 post. We did not read the other reports the FLASH cites (Google Threat Intelligence and Mandiant, Censys, Check Point, CERT-EU, Akamai, Zscaler) and are relying on the FBI's summary of them. Holdings come from a lookup of each indicator in our own index on November 15. We did not probe any address.

Sources

  • FBI, FLASH-20261113-001, "Threat Overview of ARTEX Autonomous Penetration Testing Framework," November 13, 2026: https://www.ic3.gov/CSA/2026/261113.pdf
  • Microsoft Threat Intelligence, "ARTEX abuse expands as cybercriminals target financial sector," November 6, 2026: https://www.microsoft.com/en-us/security/blog/2026/11/06/artex-abuse-expands-as-cybercriminals-target-financial-sector/
  • Microsoft, "AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise," October 21, 2026: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
  • BleepingComputer, "FBI warns ARTEX AI hacking tool is powering global cyberattacks," November 15, 2026: https://www.bleepingcomputer.com/news/security/fbi-warns-artex-ai-hacking-tool-is-powering-global-cyberattacks/
  • Our earlier posts: https://www.dugganusa.com/post/artex-off-the-rack-vapor-panda-crowdstrike and https://www.dugganusa.com/post/artex-docker-image-backdoor-62-consoles

Five percent of this is wrong somewhere. It always is.

Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.

Every indicator in this post is in the feed. Free.

1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.

Get your free key → analytics.dugganusa.com/stix/register