NEWS / NOV.2026
FBI warns of intrusions using ARTEX, an AI tool designed for security
On November 13, 2026, the FBI issued an alert about cyberattacks using ARTEX. In several Storm-0940 attacks on cloud infrastructure, Microsoft found that less than three hours elapsed between initial targeting and the attackers gaining elevated privileges on the system.
The FBI has issued an alert about ARTEX after intrusions in which less than three hours elapsed between initial targeting and the attackers gaining privileged access.
On November 13, 2026, the FBI published a bulletin on intrusions using ARTEX. The US federal law enforcement agency compiles indicators observed across several campaigns and details the corresponding protective measures.
ARTEX uses artificial intelligence to automate several stages of a penetration test, an exercise used to assess the security of a computer system. The FBI has documented the tool’s use in attacks dating back to at least August 2026.
Microsoft tracked Storm-0940’s progress during several attacks on cloud infrastructure. Less than three hours elapsed between initial targeting and the moment the attackers gained elevated privileges on the system. Microsoft separately describes the compromise of the ConnectWise Cloud Backup service without specifying which intrusions it timed.
A security team measures its response time from a different starting point, the time of its first internal alert. The team can compare that with the time it cut off the intruder’s access. Records of connections and permission changes can help the team reconstruct what access the intruder already had when the alert was raised.
In South Korea, attackers used ARTEX against the financial sector from late September to early October. CrowdStrike documented this separate campaign on October 7.
According to industry publications cited by CrowdStrike, the attackers are believed to have compromised a service that brokers use to track loans. The publications also report an attack on a mobile app for employees of another bank.
The FBI estimates that about 67,000 people had their personal data stolen during the campaign in South Korea.