Securityblog

ARTEX, an AI-native autonomous penetration framework tied to Chinese 🇨🇳 Storm-0940, was observed attacking live AWS environments in October 2026, hunting for financial data, secrets, and cloud credentials through compromised IAM keys and public Cognito pools. Key findings: - ARTEX is a hosted, LLM-orchestrated attack platform published on GitHub in July 2026, reaching 12,000 forks before going closed-source on October 8. Hundreds of internet-exposed consoles were found, most presenting a Chinese-language login page titled "ARTEX - Autonomous Penetration Testing Console," with infrastructure concentrated in Singapore 🇸🇬 and Hong Kong. Microsoft attributed it to Storm-0940. The platform supports OpenAI, Anthropic, DeepSeek, and compatible gateways, rotating across API keys and providers if one is blocked, so a single campaign can span multiple inference providers. - Two initial access paths were observed in the wild. First: compromised long-term AKIA IAM access keys. Once in, ARTEX's dominant action was FilterLogEvents with a consistent limit of 1000, searching CloudWatch for financial institution names combined with terms like Fund, Invoice, Billing, and LLC, then widening to queries for "s3://", "presigned", ".pdf", ".xlsx", ".csv", AKIA strings, internal IP ranges (172., 10.), passwords, and MongoDB references. Activity on October 20 originated from 103.54.154[.]40, an IP resolving to zeofast[.]cn. - Second path: public Amazon Cognito user pools with anonymous sign-up enabled. A spike on October 26-27 from 154.64.252[.]77 showed ARTEX iterating through PreSignUp Lambda validation errors (including attempts using api.github[.]com and example[.]com as tenant domains), then completing the full flow: SignUp, InitiateAuth, RespondToAuthChallenge, GetUser, GetTokensFromRefreshToken. It then attempted broad read-only enumeration: ListBuckets, ListSecrets, DescribeParameters, ListFunctions20150331, GetRestApis, and more under the CognitoIdentityCredentials role session name. In this case, the authenticated role lacked permissions and all calls failed. - Every session reviewed opened with unauthenticated S3 requests appearing in CloudTrail with userIdentity.type of AWSAccount and accountId of anonymous. ARTEX also performed pre-fuzzing baseline requests using placeholder keys like zzz_nonexistent_abc.txt and Notexist-xyz before bursts of S3 enumeration. A request for a clearly nonexistent object name immediately before a guessing burst is a detectable behavioral signal. User agents are inconsistent but include artex-readonly/1.0, artex-pentest/1.0, artex-spawn/1, ARTEX-worker/1.0, and Mozilla/5.0 ARTeX, among others listed in the report's IOC table. Practitioner takeaway: In CloudTrail, hunt for FilterLogEvents calls with limit=1000 at volume, anonymous S3 access preceding credential use, and CognitoIdentityCredentials session names followed by broad Get*/List* enumeration. Cross-reference against the IP list in the report, which includes 103.54.154[.]40, 154.64.252[.]77, 154.36.136[.]197, 154.36.136[.]23, 82.158.88[.]233, and others. Flag any S3 request for objects matching zzz or notexist patterns immediately before an enumeration burst. The report's IOC table covers 10 IPs and 10 user agent strings. Rotate or remove long-lived AKIA keys: they are ARTEX's preferred foothold. #DFIR_Radar