ARTEX

CrowdStrike reports that VAPOR PANDA used ARTEX with DeepSeek and an unidentified commercial model to run parallel intrusions under human direction. It distinguishes more than 200 targeted organizations from nine with confirmed post-exploitation activity, and separates this campaign from Storm-0940.

Microsoft Threat Intelligence reports that Onyx Sleet and Pearl Sleet used ARTEX in operations from late October 2026. Its broader assessment describes North Korean actors using AI to accelerate established targeting, social engineering and tooling workflows, while explicitly judging the operations human-directed rather than fully autonomous.

Microsoft attributes the ConnectWise Cloud Backup compromise to the China-state-aligned actor Storm-0940 and reports that it used ARTEX to automate attacks and abuse stolen application identities across customer Microsoft 365 tenants. Microsoft says most targeting failed and that application exposure or a successful sign-in alone does not establish data access. ConnectWise’s October 28–29 updates describe phased restoration through a new application, requiring tenant reauthorization and verification that backups actually resume; they do not establish complete service restoration.

CrowdStrike Intelligence reports a campaign against South Korean financial organizations, active from late September to early October 2026, that resulted in exfiltrated data, and says open directories on actor-controlled servers held Claude Code session histories, ARTEX configuration files and Claude memory files. CrowdStrike assesses with moderate confidence that the unattributed actor is a financially motivated Chinese speaker, and says the ARTEX instance used DeepSeek v4.1-flash as its main model, with GLM-5.3 and Grok 4.6 used in further Claude Code sessions. Press reports name Shinhan Bank, KB Kookmin Bank and Hana Bank among the victims; press reports at least seven institutions and about 68,000 people, while CrowdStrike calls the number of affected organizations unconfirmed.