Timeline

ARTEX first public release (v0.1.0)

Autumn-27/ARTEX made its first commit and released v0.1.0. v0.3.14 was released on Sep 24, and v0.3.15 was tagged on Oct 7.

Microsoft: ARTEX searches GitHub for leaked secrets, 5 minutes to Key Vault exfiltration

Heavy querying of GitHub for secrets since August 2026. From Oct 28, leaked application credentials were used to sign in to Entra ID as service principals. In at least one case, it took only 5 minutes from searching GitHub to Azure Key Vault exfiltration.

Confirmed victims: Unnamed organizations (at least one case of exfiltration)

Operator prompts mention organizations in 19 countries and regions

In operator records recovered by Zscaler, prompts asked for scans of organizations in these places. No attacks were confirmed and no victims were reported.

Targets: Organizations in Canada, China, Cuba, Hong Kong, India, Indonesia, Japan, Kazakhstan, Kenya, Malaysia, Nigeria, South Africa, South Korea, Taiwan, Thailand, the UAE, the UK, the US and Vietnam (not named)

Mandiant incident response: multiple actors use ARTEX

Observed since late August. Includes profit-driven actors conducting data-theft extortion. Webshells were dropped by writing to logs, and results were sent back through 491 rotating webhook.site URLs.

Confirmed victims: US government, technology, chemicals and materials, and manufacturing organizations (not named)

Small Indian NBFCs lose about ₹300 crore (media estimate)

₹300 crore is 3 billion rupees. It is a media estimate, not a total confirmed by the RBI.

Confirmed victims: Small Indian NBFCs (not named)

Seoul police: about 90 organizations, about 8.2 million records (separate case)

Police call it South Korea's first large-scale hacking case using generative AI. About 90 organizations and about 8.2 million records.

Confirmed victims: About 90 organizations including academies, hospitals, golf courses, universities and subsidiaries of large companies (not named)

GMO: about 20 Japanese companies targeted from ARTEX infrastructure

GMO confirmed ARTEX on the attack-source infrastructure, which targeted about 20 Japanese companies. GMO assesses that targets were selected by country and industry. The intelligence was handed to law enforcement.

Targets: About 20 Japanese companies (not named, 9 of them in the same industry); 8 of the targets have publicly disclosed leaks (not individually confirmed as caused by ARTEX)

UK: 123 Reg customer data accessed

Involves contact details, customer relationship data, company VAT numbers and API product information. The number of affected customers was not disclosed.

Confirmed victims: 123 Reg

GoDaddy Websites + Marketing data access on the same day

According to a notice posted by a customer, a third party read W+M profile and settings data through an API on the same day. GoDaddy has not confirmed a link to the 123 Reg incident.

Confirmed victims: GoDaddy Websites + Marketing

DIVD in the Netherlands breached

Breached through two Zammad zero-days (CVE-2026-102489, 102490). Exfiltration of volunteer user data is confirmed, and several systems show signs of partial exfiltration. No signs were seen for HR, source code, Slack or finance.

Confirmed victims: DIVD

First wave of intrusions at Korean financial institutions (7 institutions)

The earliest known attack date is Sep 27. The first report to the authorities came on Sep 30 (Shinhan). Disclosures followed from Oct 1 to Oct 4. The attack surface was mainly external-facing edge applications, and the methods included SQL injection and authentication bypass. A Financial Security Institute (FSI) official said it was not a fully autonomous attack without human involvement.

Confirmed victims: Shinhan Bank; KB Kookmin Bank; Hana Bank; BNK Busan Bank; Yegaram Savings Bank; Hyundai Capital; Welcome Savings Bank

Targets: Woori Bank (says it blocked the attack); NH NongHyup Bank (says it blocked the attack)

Korean financial intrusions expand to 16 institutions

Beyond the first wave of 7, another 9 were confirmed, for a total of 16 institutions and about 100,000 records. The list includes P2P firms, crypto-asset firms and Saemaul Geumgo (MG Community Credit Cooperatives). Information that allows direct fraudulent use, such as account numbers and card numbers, was not confirmed. SBS reported in the same period that data leaked at some institutions included account numbers. The two accounts differ.

Confirmed victims: DB Savings Bank; OK Savings Bank; KDB Capital; PFCT; Mouda; Brightpix; Streami (GOPAX); Pravang; Saemaul Geumgo (MG Community Credit Cooperatives) Central Federation

ARTEX user targets IT and software vendors (Wiz / UNC7228)

Password spraying against Okta and Entra and attacks on internal login pages, with some sessions lasting 24 to 30 hours. Wiz says most attempts failed. GTIG reports intrusions and data theft.

Targets: Multiple IT and software vendors (not named)

Korean, English and Japanese localizations and derivatives appear

The ScopeWeaver repository was created on Oct 2. The artex-ko repository was created on Oct 3 and later renamed artex-global. The earliest Japanese version dates from Oct 9. AhnLab recorded derivatives including ScopeWeaver, Tangora PTaaS, Horda, Meze, AegisLoop and Bob Research Labs.

Taiwan: 91APP order database accessed

The attacker entered through the internal tool Appsmith, obtained a database key from GitLab and accessed an order database. No credit card or other payment information was involved. The stolen data was later used in scam messages targeting brand customers.

Confirmed victims: 91APP; Platform brand customers and their consumers

Public detection rules and internet-mapping queries

artex-ko added Sigma rules on Oct 5. Theori created aipt-detections on Oct 12 and published a white paper on Oct 15. Censys, Hunt.io and RST Cloud published internet-mapping queries, and BadByte published YARA rules.

Public ARTEX console counts

Methods and dates differ by vendor. AhnLab cautions that these IPs cannot all be treated as attacker addresses. Censys says about 650 are hosts with the same configuration, and about 815 deployments are actually distinguishable.

Upstream repository taken down, project goes closed-source

Wayback recorded the first upstream 404 at Oct 8 10:15 UTC. The statement on the author's profile page is dated Oct 8. The statement says public updates have stopped. The official image autumn27/artex has been removed from Docker Hub.

Forks and copies surge after takedown

Backups and English versions began appearing within two minutes of the upstream takedown. GitHub search on Nov 6 shows existing repositories with artex in the name: 15,529 forks since Sep 27, 15,826 including non-forks, and 10,493 from Oct 8 to Oct 14.

Poisoning: popular copy swapped to a backdoored Docker image

trhhubsd/ARTEX changed only one line of docker-compose.yml, swapping the image to tomicdd/artex. The image hides unauthenticated command execution in the login endpoint. It exists only in the precompiled binary, so it cannot be seen by reading the source. A second image, congdonglinux/artex, has the same digest. Docker removed both images on Nov 5.

India CERT-In: CRAFTY FALCON attacks the financial sector

Severity is Critical. This is an update to CIAD-2026-0046 of Oct 9. The attacker called the victims' own payment and lending APIs, ran small tests of 1 rupee and then moved to large amounts. The public version has no victims, counts or IoCs. Full IoCs are given only to BFSI entities in the TLP version.

Confirmed victims: NBFC and fintech entities (not named)

Targets: NBFCs, digital lenders, payment aggregators, crypto exchanges and others

ConnectWise Cloud Backup credentials abused; Storm-0940 targets M365 tenants

Discovered on Oct 14, disclosed on Oct 16, attributed by Microsoft on Oct 21. Most targets were not successfully compromised, but several attacks gained privileged cloud access, some in under 3 hours from first targeting to privileged access. Microsoft gave no count of successes.

Confirmed victims: ConnectWise (Cloud Backup); 162 tenants confirmed by Huntress

Targets: 2,250+ M365 tenants (attempted sign-in); 327 accounts at 8 organizations (password spraying, no success observed)

Storm-0940 infrastructure abuses Okta self-registration (Expel customer)

Created 5 accounts. 3 enrolled in Okta Verify, and one of them completed 50 successful SSOs. Existing accounts were not compromised.

Targets: The Okta tenant of one Expel customer (not named)

Check Point: misconfigured ARTEX instances expose cybercrime operations

Most attacks run fully autonomously once the target is set. Configurations mainly use Chinese models, with DeepSeek Flash the most common.

Confirmed victims: 10 gray-market iOS signing shops; 13 gaming credential backend servers

Targets: 292 crypto payment domains (failed, no transfers resulted)

VAPOR PANDA uses ARTEX to target more than 200 organizations

A single ARTEX controller was directed at at least 14 countries within 11 days. 200+ is the number of targets, not compromises. ARTEX was not the only tool: the BLOODALCHEMY backdoor, webshells, Chisel and SoftEther were also used.

Confirmed victims: Interior ministry of a Middle Eastern country; Foreign ministries of two Latin American countries; Telecom operators in the US, Belgium and the Philippines; Other unnamed organizations (CrowdStrike confirmed post-exploitation at 9)

Targets: 200+ organizations in at least 14 countries; Multiple ministries of a European country; 19 US organizations; Foreign ministries in Central America and Asia (target files prepared)

Follow-on intrusions in Korea's financial sector (cumulative 37 institutions, 40 incidents)

The Financial Services Commission (FSC) said on Nov 5 that from Sep 30 to Nov 3 there were intrusion reports from 37 institutions covering 40 incidents and about 473,000 records, and that some small institutions had about KRW 1 billion of self-managed funds stolen. The list was not published. 22 institutions have been publicly named. Many were entered through groupware or external connection points. As of Nov 6 there is no public report of a final penalty or an arrest in the financial cases.

Confirmed victims: Mirae Asset Life Insurance; Daishin Securities; Mirae Asset Global Investments; Bithumb; Hanyang Securities; Zoomfund; Pravang (second incident)

Targets: Energy Infra Asset Management (attempted, no leak confirmed)

Japan: Onamae Desktop Cloud breached

The attacker demanded about JPY 8 billion. GMO says no link to ARTEX has been established.

Confirmed victims: GMO Internet (Onamae Desktop Cloud)

Microsoft: Onyx Sleet and Pearl Sleet use ARTEX

No target organizations are described. Microsoft assesses that these actors mainly use AI to enhance existing techniques.

JPCERT/CC alert Case E: attack attempts abusing AI penetration testing platforms

The alert confirms attack attempts, not victims. The listed IPs may also have legitimate uses.

Targets: Organizations in Japan (not named)

Chainstack breached

Entered the development environment through a third-party component on Oct 26, entered part of the production environment on Oct 29, and was discovered and cut off on Oct 31. May include organization names, account holder names, member emails and password hashes. Node credentials are treated as exposed.

Confirmed victims: Chainstack

Chainalysis discloses intrusion

Involves non-sensitive customer information such as user IDs. Some reports list names, emails and organizational roles. The entry point, duration and scale of impact were not disclosed.

Confirmed victims: Chainalysis

WorkOS internal sales tool accessed

Only CRM and customer support data was involved, including contact details, account relationships, and summaries of sales and support calls and Slack. There is no evidence that application data was accessed. The number of people and the entry point were not disclosed.

Confirmed victims: WorkOS