FBI FLASH on ARTEX: TTPs, IOCs, and What Agent Users Should Hunt

On November 13, 2026, the FBI published FLASH 20261113-001 describing how threat actors weaponize the ARTEX autonomous penetration testing framework across financial, government, technology, and defense targets. The TLP:CLEAR document is the first U.S. government FLASH Beam has seen dedicated to an agentic offensive platform. It pulls together TTPs, sample indicators, and mitigations already documented by Microsoft, CrowdStrike, and Datadog, and it adds a single reporting checklist for IC3.

If you run AI coding agents on laptops that also touch cloud API keys, partner-portal code, or multi-tenant SaaS configs, this post translates the FLASH into concrete hunts—not because ARTEX runs inside your IDE, but because it automates the same credential and API abuse paths your agents can accidentally amplify when secrets leak.

TL;DR

What the FLASH says happened

The FBI summarizes ARTEX as an open-source, LLM-driven agentic platform that threat actors use to automate reconnaissance through exfiltration at machine speed. Since at least August 2026, multiple actors have used it across sectors the document lists explicitly: financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications, and legal industries.

Three quantitative claims in the executive summary matter for defenders:

1. Timeline compression — Some intrusions moved from initial targeting to privileged access in under three hours.
2. South Korean financial campaign — Financially motivated activity against institutions with personal information on approximately 67,000 individuals (the FLASH cites open reporting on that campaign, consistent with CrowdStrike's Vapor Panda disclosure and South Korea bank reporting).
3. ConnectWise supply chain — A compromise path through ConnectWise Cloud Backup that enabled access to more than 2,250 downstream tenants, matching Microsoft's Storm-0940 analysis.

The FLASH also notes that after Autumn-27 removed the original GitHub repository on October 8, 2026, abuse continued through forks, localized variants, archives, and a commercial “ARTEX PRO” build. Researchers cited in the document identified more than 1,600 publicly exposed ARTEX consoles by early November 2026, with higher totals likely behind firewalls—figures in the same ballpark as Censys and SOCRadar exposure work and Check Point's operator-console research.

Inside the framework (per the FBI)

ARTEX is described as a Go-based, multi-agent system that turns natural-language objectives into tool execution by specialized agents, with minimal operator interaction after the goal is set. It does not ship its own model; operators plug in Anthropic, OpenAI, DeepSeek, GLM, Grok, Kimi, and other providers. Analysts of attacker consoles reported DeepSeek Flash family models as prevalent, citing cost and weak guardrails when framed as penetration testing—consistent with Check Point's console telemetry.

The FLASH highlights operational risks that differ from classic botnets:

• Accelerated multi-target operations — Small teams running concurrent campaigns.
• Peripheral surface focus — Partner portals, mobile backends, employee apps, and legacy integrations rather than only flagship sites (aligned with Unit 42's behavioral hallmarks).
• Supply chain pivoting — Trust relationships and weaker vendors as entry to upstream networks (the ConnectWise narrative is the documented U.S. example).
• Compressed defender window — Noisy traffic may alert, but speed can finish objectives before coordinated response.

Attack chain mapped to MITRE ATT&CK

The FLASH includes a phase table tying observed ARTEX activity to ATT&CK techniques. Rather than repeating every ID, the chain clusters as follows:

Reconnaissance and cloud discovery

Operators run active scanning, cloud permission discovery, and ARM deployment validation dry-runs with hundreds of sub-second checks. Datadog's AWS hunting guide documented similar FilterLogEvents secret searches once long-term IAM keys work (Datadog ARTEX AWS post).

Initial access and trust abuse

Documented paths include exploiting public-facing apps, valid accounts, supply chain compromise, SAML forgery, and cross-tenant B2B trust abuse—the ConnectWise pattern Microsoft Threat Intelligence detailed in October 2026.

Persistence and privilege

The FLASH lists web shells, cloud credential additions, DLL hijacking, RAT deployment (WISP, vshell, AdaptixC2), and Kerberoasting—overlapping Microsoft's Storm-3358 financial-sector IOC table published November 6.

Collection and staging

Behaviors include mailbox collection, cloud secrets store access, data staging, and webhook.site-style callback rotation—the same callback pattern Google and Mandiant noted in late October incident response cases.

Sample indicators (investigate before blocking)

The FBI stresses that cloud IPs rotate and that listed addresses are historical observations. Validate against live telemetry. Sample entries include:

Behavioral indicators include burst HTTP enumeration, structured PII exfil over HTTPS, unexpected LLM API egress (api.anthropic.com, api.deepseek.com, open.bigmodel.cn, api.x.ai), and web shells under unusual .aspx or .jsp paths. Community detection packs such as Malware Must Die's TLP:CLEAR ARTEX signatures published the same day add Sigma, Sentinel, and Suricata logic defenders can test offline.

FBI mitigations translated into a checklist

The recommendations section is lengthy; these are the actions most relevant to teams who also run coding agents in the same environment.

Shrink what ARTEX can see from the internet

• Inventory peripheral internet-facing apps—not only customer marketing sites.
• Restrict Kudu/SCM, backup consoles, hypervisors, and publishing interfaces to trusted networks.
• Prefer Zero Trust access over raw public admin URLs where feasible (Mandiant's five layers made the same point).

Treat SaaS and B2B apps as intrusion lanes

• Apply least privilege to multi-tenant app permissions; audit credential additions and app-only sign-ins.
• For ConnectWise-class apps, search by application ID in every tenant that ever consented—even churned customers (Storm-0940 hunting steps).
• Do not trust source-IP allow lists alone; the FLASH notes vendor traffic may originate from provider-private addresses.

Harden high-impact APIs

• Rate-limit partner and employee portals; alert on sequential record lookups and high distinct-object counts per session (the South Korea campaign's slow exfiltration pattern).
• Stop returning verbose errors to unauthenticated callers.
• Scan repos, CI/CD, and IaC for embedded secrets and rotate anything exposed—ARTEX explicitly hunts credentials in files and bundles.

What this means if you run AI coding agents

ARTEX does not install inside Claude Code, Codex, or Cursor. The FLASH still changes your local risk picture in three ways:

1. Same secrets, faster opponent — If a long-lived AKIA key or OAuth client secret lives in a .env your agent reads during a refactor, ARTEX-class tooling can weaponize it minutes after it hits an exposed config—faster than manual red teams (PHP2Shell speed context applies to the defender clock, not the exploit class).
2. Peripheral repos matter — Partner-portal and internal sales tools are where junior developers—and agents—often work without production-grade review. The FBI explicitly calls those systems first-class targets.
3. Do not mistake IDE safety for tenant safety — A clean laptop does not help if the agent pushes a ConnectWise test credential into a public fork or logs a Graph token into CI output.

Concrete checks before your next agent session on a cloud-backed repo:

# List unexpected long-lived cloud keys in the tree (adapt paths to your stack)
rg -n 'AKIA[0-9A-Z]{16}|ASIA[0-9A-Z]{16}' --glob '!.git'

# Confirm ConnectWise-related app IDs in Entra (replace with your tenant tooling)
# Microsoft documents affected application IDs in its Storm-0940 post — compare audit logs since 2026-10-01.

Rotate anything found, scope keys to single purposes, and prefer short-lived workload identity over static files.

What Beam can and cannot do here

Beam watches tool use on developer machines through hooks (Claude Code and Codex PreToolUse) and heuristically scans skills and MCP configs before you run them. It can flag when an agent tries to read credential files or run high-risk shell patterns, and it redacts known secret formats before local storage.

Beam does not ingest FBI FLASH feeds, Entra audit logs, or WAF telemetry. It is not a replacement for Microsoft Defender, Sentinel, or the SIEM hunts the FLASH assumes. Workspace enforce mode is hook-based, not a kernel sandbox, and missing cached policy can fail open—use it as one layer, not the only layer.

Reporting to IC3

If you confirm ARTEX-linked activity, the FLASH requests eight evidence categories: console artifacts, authentication logs, Graph/Entra audits, LLM egress indicators, cloud/container logs, exploitation artifacts, attack timing characteristics, and impact totals. File through ic3.gov and include FLASH reference 20261113-001.

Independent researcher Malware Must Die released complementary TLP:CLEAR detection content the same day; it is useful for rule authors even though it is not an FBI product.

Frequently asked questions

The FAQ in the front matter covers the FLASH scope, primary PDF location, cited campaigns, network indicators, Microsoft 365 steps, and the coding-agent angle. If your organization receives the FLASH through a closed distribution list, treat the IC3 PDF as the public reference copy for citations and version control.

Related reading

• Storm-0940 and ARTEX: ConnectWise to 2,250 tenants
• Vapor Panda and ARTEX at machine speed
• Datadog: ARTEX in AWS and CloudWatch hunting
• Google and Mandiant: five defense layers
• GitGuardian: agentic pentest framework catalog
• Beam landing: what Beam watches and local-first storage

Indicators, application IDs, and exposure counts in this post reflect the FBI FLASH and vendor sources cited above as of November 13, 2026. Re-check primary documents before blocking infrastructure or revoking production app consents.