Follow-Up: FBI Issues Formal ARTEX Alert, Hackers Using Super Intelligence (SI) Tool Can Gain Privileged Access in Under Three Hours
The Federal Bureau of Investigation (FBI) on November 13 issued a formal alert, FLASH-20261113-001, warning that a variety of malicious cyber actors have weaponized the open-source penetration testing framework ARTEX since at least August 2026, automating multiple phases of cyber intrusions at machine speed, from reconnaissance through data exfiltration, with some intrusions progressing from initial targeting to privileged access in under three hours.
ARTEX is a large language model-driven, multi-agent platform written in Go. It translates high-level goals described in natural language into machine commands executed by specialized agents, requiring minimal human interaction beyond setting the objective. It does not include its own model, but integrates with external providers including Anthropic's Claude and OpenAI's GPT, as well as DeepSeek, GLM, Grok and Kimi. The FBI said Chinese models are the most prevalent in attacker-controlled instances, with DeepSeek's Flash family dominating because of its capability, relatively low cost and lack of observable guardrails when framed for penetration testing.
The alert lists ten targeted sectors: financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications and legal services. The FBI said the framework significantly reduces the time needed to chain attack techniques and enables actors with minimal technical expertise to run complex operations against several targets at the same time.
The alert names two campaigns. One involved financially motivated attacks on South Korean financial institutions that exfiltrated personal information from approximately 67,000 individuals. The other was a supply chain compromise affecting ConnectWise Cloud Backup customers that enabled access to more than 2,250 downstream tenants. GSM reported in October on Microsoft's disclosure that the China-aligned group Storm-0940 had used ARTEX against ConnectWise; this is the FBI's first formal FLASH alert on the framework.
ARTEX was released on GitHub in July 2026 by a developer using the name Autumn-27, who said it was meant for authorized security testing. The developer removed the repository on October 8, 2026, after reports of abuse. The FBI said the framework still circulates through community forks, localized versions, archived copies and a paid edition called ARTEX PRO. As of early November 2026, researchers had identified more than 1,600 publicly exposed ARTEX console instances, with the true total likely significantly higher once systems behind firewalls are counted.
The FBI urged organizations to inventory every internet-facing application, including peripheral and forgotten ones, restrict cloud administration and application-publishing interfaces to trusted networks, apply least-privilege rules to multi-tenant application permissions, watch for new credentials being added to applications, and scan code and configurations for embedded secrets and rotate any that are exposed. Anyone who suspects they have been targeted is asked to contact their local FBI field office or report through the Internet Crime Complaint Center at ic3.gov. (Source: Federal Bureau of Investigation)
Source: Federal Bureau of Investigation
Published by GSM · USA (original Chinese edition)
Photo: 图：位于华盛顿的联邦调查局（FBI）总部胡佛大楼。ajay_suresh 摄，CC BY 2.0 授权，经 Wikimedia Commons；GSM 联邦固定图库。 / Photo: The J. Edgar Hoover Building, FBI headquarters in Washington. Photo by ajay_suresh, CC BY 2.0, via Wikimedia Commons (GSM federal fixed image library).
- 2026-10-21Microsoft Says China-Aligned Storm-0940 Used SI Tool ARTEX in ConnectWise Supply-Chain Compromise: Hundreds of Organisations Targeted Worldwide
- 2026-11-14Follow-Up: FBI Issues Formal ARTEX Alert, Hackers Using Super Intelligence (SI) Tool Can Gain Privileged Access in Under Three HoursThis story
