ARTEX Agentic AI Framework: Cross-Actor Cloud Identity Abuse and OAuth Supply-Chain Compromise

ARTEX is an open-source multi-agent large language model framework that chains reconnaissance, credential attacks, and cloud abuse through a planner agent and worker agents, sustaining thousands of actions per minute and reaching privileged access within three hours in some cases. The framework is known to be used by multiple China-nexus threat actors: Storm-0940, a state-aligned actor active since 2021, used ARTEX to abuse the trusted relationship of a compromised multi-tenant ConnectWise OAuth application and reach downstream Microsoft 365 tenants at scale, with public reporting describing sign-ins against roughly one thousand Entra tenants and successful access in several hundred; and Vapor Panda, which used the same framework against South Korean financial organizations.

ARTEX itself is an open-source autonomous penetration-testing system that was published openly as both source code and precompiled binaries; the original repository has since been taken down, but copies and binaries continue to circulate, so the barrier to adoption remains low for unrelated operators. It runs as a multi-agent system: one agent breaks a high-level goal into tasks, a planner decides the next actions, a pool of worker agents carries them out, and a chat agent keeps a human in the loop, all drawing on a shared map of discovered assets and powered by commercial large language models. The project states it is intended for isolated study only, but both operators ran it against live corporate identity providers and cloud tenants.

Initial access centered on automated password spraying against Microsoft Entra and Okta, with bursts that rotated user agents and source addresses between attempts, alongside the use of a stolen vendor application credential presented as a client assertion. With that credential the actor authenticated non-interactively through already authorized applications and requested Microsoft Graph tokens inside customer tenants without an interactive user sign-in. Where the application held no service principal in a tenant the authentication failed, producing a repeating pattern of one external source attempting the same application across many tenants in sequence. Against web applications and AWS Cognito the operators enumerated usernames, exercised account recovery and self registration flows with disposable mailboxes, and submitted forged and unsigned tokens across large numbers of single sign-on routes.

For persistence the actor added new client secrets and certificates to existing OAuth applications and service principals, including secrets configured with multi-year expiry, and assigned privileged directory roles to applications under its control, in several cases granting Global Administrator or Exchange Administrator. Using the acquired tokens the operators performed account and directory discovery through Microsoft Graph, retrieved secrets in bulk from Azure Key Vault, and accessed mailboxes, Teams messages, and SharePoint Online content before exfiltrating data. The service principals moved through customer tenants in sorted identifier order a few seconds apart, consistent with a scripted target list.