FBI ARTEX flash: 1,600 consoles, 67,000 people, 2,250 tenants; all 11 endnotes are other publishers' work

Eleven endnotes, eight publishers, and none of them the FBI's own

The FBI's ARTEX FLASH (number FLASH-20261113-001, marked TLP:CLEAR, dated 13 November 2026) has 11 endnotes. They come from 8 publishers (derived: Akamai, Microsoft and Google Threat Intelligence Group two each; Censys, CrowdStrike, Zscaler ThreatLabz, CERT-EU and Check Point Research one each; 2 + 2 + 2 + 5 = 11). Every one is another organisation's report, dated from 7 October 2026 to November 2026. The Notes list names no FBI case file, interview or telemetry. Each headline figure carries one: "under three hours" rests on endnote 2, "approximately 67,000 individuals" on endnotes 6, 7 and 8, "more than 2,250 downstream tenants" on endnote 2, and "over 1,600 publicly exposed ARTEX console instances" on endnote 4.

What that does not establish. It does not show that the FBI holds no data of its own, or that any figure is wrong. An endnote says whose number it is, not how that publisher got it, and the FLASH says nothing about whether or how the FBI checked any figure. The Censys post named in endnote 4, as saved on 14 November, prints 1,465 hosts and no figure near 1,600 (section below). The FLASH's table of ATT&CK phases carries no endnote at all.

Interests, stated once each. The FBI is a US agency, and a FLASH is a request for reports as well as a warning: it asks readers to contact a field office or the Internet Crime Complaint Center and lists 8 kinds of information it wants (derived: 8 numbered items), among them the "Total number of compromised accounts or affected users", which the FLASH does not give. Censys sells internet scanning and attack surface products, and its figure is a scanner's count. Amazon sells AI and cloud services and writes about threats seen on its own platform; its post, saved here, is not one of the 11 endnotes. Seven of the eight endnote publishers are companies that sell security or cloud products; CERT-EU is not a company (this site's reading of the names, since the FLASH describes none of them).

What the FLASH says, in its own order

ARTEX is described as an "open-source, large language model (LLM)-driven agentic platform" that threat actors have weaponized to automate phases of intrusions "at machine speed, from reconnaissance through data exfiltration". "Since at least August 2026", the FLASH says, a variety of actors have used it against organisations in ten named sectors (derived count: financial services, government, technology, defense, semiconductor, energy, healthcare, manufacturing, telecommunications, legal). It names two campaigns: attacks on South Korean financial institutions, and a supply chain compromise of ConnectWise Cloud Backup customers. It says the original developer "removed the GitHub repository in October 2026", that the framework "continues to proliferate through community forks, localized variations, archived copies, and a commercial version (ARTEX PRO)", and that researchers found "over 1,600 publicly exposed ARTEX console instances" in early November, "with total deployments likely significantly higher when including systems behind firewalls or in private networks".

On models, the FLASH says ARTEX has no model of its own but works with outside providers, and that "Chinese models are most prevalent, with DeepSeek Flash family models dominating usage" in attacker-controlled instances (endnotes 7 and 9). On pace it says "some intrusions progressing from initial targeting to privileged access in under three hours" (endnote 2), and that "attack speed provides limited time for coordinated defender response". The developer is described by a code-sharing handle, which this briefing does not repeat; The Record names a person, which this briefing also does not repeat.

Each headline figure, the endnote under it, and who published it

The first table sets each headline figure as the FLASH prints it beside its endnote and what this site holds for it. The second lists all 11 endnotes as printed. The pages for endnotes 2, 6 and 9 were read from copies saved for earlier briefings, not fetched now.

Zoom

2,250 tenants: three wordings of one number, and a smaller count beside it

The FLASH says the ConnectWise Cloud Backup compromise "enabled access to more than 2,250 downstream tenants", with endnote 2, Microsoft's post of 21 October. Censys, writing on 5 November about the same Microsoft post, puts it differently: "It attempted sign-ins to more than 2,250 tenants, peaking at 2,900 attempts per minute, and some victims saw privileged cloud access in under three hours". A copy of Microsoft's post saved for an earlier briefing says the actor "used ARTEX to attempt to sign-in to more than 2,250 tenants". The same figure is therefore worded as access, and as attempted sign-ins. The FLASH does not say that it means attempts.

The arithmetic, and only the arithmetic: 162 is 7.2 per cent of 2,250 (derived: 162 / 2,250 = 0.072), and 2,250 is 13.9 times 162 (derived: 2,250 / 162 = 13.89). The FLASH does not say that the two figures count the same population, and nor does Huntress or Microsoft. Huntress's count is of confirmed sign-ins in tenants it could see at one point in time. Microsoft's, as Censys and the saved copy word it, is of tenants a sign-in was tried against. This site's earlier briefing on Microsoft's report headlined 2,250 as breached; Microsoft's own words in the saved copy are about attempts, so that headline reads stronger than the saved text and should be read with this difference in mind.

The three hours has the same shape. The saved copy of Microsoft's post says "Several of these Storm-0940 ARTEX-driven attacks" reached privileged access, "including multiple instances" under 3 hours: several attacks by one actor, not every ARTEX user and not all 2,250 tenants. The FLASH says "some intrusions" and places the sentence among general statements about ARTEX. It does not say whether the under three hours was one case or typical, and Censys's paraphrase, "some victims saw privileged cloud access in under three hours", adds no number of cases. The FLASH names no actor for the ConnectWise campaign in its text; Censys names Storm-0940 as Microsoft's attribution, and The Record says "Microsoft said Artex was used by Chinese state-backed actors". Neither is in the FLASH.

1,600 consoles: the Censys post named in endnote 4 prints 1,465

The FLASH says researchers "identified over 1,600 publicly exposed ARTEX console instances" as of early November 2026, with endnote 4, Censys's post of 5 November. The Record repeats it: the advisory "cites recent research from cybersecurity firm Censys showing over 1,600 publicly exposed Artex console instances". The Censys post, as saved on 14 November, says "As of November 4, 2026, Censys observed 1,465 hosts running an exposed ARTEX console", and prints no figure from 1,600 to 1,699 (checked in the saved text). The table sets every count side by side. None is resolved here.

Arithmetic (derived): 1,600 minus 1,465 is 135. The two hosting blocks are 493 and 157 hosts, which is 650 (493 + 157), 44.4 per cent of 1,465 (650 / 1,465), and leaves 815 (1,465 minus 650). Censys says about 44 per cent and "suggest a provisioning template rather than hundreds of individual operators". The FLASH's over 1,600 is above Censys's 1,465 by 135 and is consistent with Check Point's 1,608, but the FLASH attaches endnote 4, not endnote 9, to it. This site cannot say where the FBI's number came from. A later Censys update that the saved copy does not show cannot be ruled out; the saved copy is dated 5 November.

Who runs them is not stated. The FLASH says "publicly exposed ARTEX console instances" and does not say how many are run by attackers. Censys says "Not every ARTEX instance is operated with malicious intent, and some of the hosts publicly exposed are likely operated by authorized testers". Censys adds that "155 ARTEX hosts (10.6%) also run at least one other threat that Censys detects" (derived: 155 / 1,465 = 10.58 per cent) and that there were "32 open directories run on other ARTEX hosts today". None of these gives a count of attacker-run consoles. The FLASH also says deployments behind firewalls are likely more; Censys says "overall global deployment is likely higher".

67,000 people: three endnotes and no split

The FLASH says the South Korean attacks resulted in "exfiltration of personal information from approximately 67,000 individuals", with endnotes 6, 7 and 8: CrowdStrike (7 October), Zscaler ThreatLabz (14 October) and CERT-EU (5 November). It does not say which endnote gives the number, or how the three were combined. The copy of CrowdStrike's post saved for an earlier briefing says "the number of organizations affected remains unconfirmed" and gives no count of people, as this site's earlier briefing on that post found. That briefing summed the counts that Korean press reports attributed to individual firms and got 67,599 in mixed units (people, individuals, cases, outsourced workers), and said the total is neither a count of people nor of records.

The FLASH's approximately 67,000 is 599 below that press sum (derived: 67,599 minus 67,000), or 0.9 per cent. The FLASH does not say its figure comes from there. Zscaler's and CERT-EU's posts were not read by anyone on this site, so which of the three endnotes carries the number, and in what unit, is not known. The FLASH's own request for information lists the "Total number of compromised accounts or affected users" as something it wants from victims, which suggests no such total is printed in the FLASH. That is this site's reading, not a statement in the FLASH.

The ATT&CK table has no endnote, and some of its lines are Google's

The FLASH's table "maps observed ARTEX activity to MITRE ATT&CK phases". It has 8 phases, 50 listed activities and 46 technique listings (43 distinct IDs), all counted by this site from the printed table (derived). It carries no superscript endnote, so the FLASH does not say who observed the activity. Several lines match Google's post of 30 October (endnotes 3 and 5) in an earlier saved copy: "Tested compromised IAM user permissions using DryRun flags", "Abused Kudu administrative APIs to execute arbitrary commands" and "Enumerated over 110,000 Active Directory objects" appear word for word, and that post has its own table headed "Observed ARTEX Activity Mapped along the phases of a targeted attack lifecycle". Other lines (LAPS passwords, new 100GB volumes, residential proxies, Chisel and SoftEther) are not in that copy. So the table looks like a composite of several observations, and the FLASH does not say whose. The wording was compared by this site; the FLASH does not say it was copied.

Zoom

Three details are worth holding on to. Only one phase, Lateral Movement, says the attempts were stopped: "blocked by endpoint protection". One Internal Recon line says the agent "Inventoried endpoint sensor coverage to identify Windows machines without CrowdStrike Falcon". And one technique ID is printed T11558.003, with five digits before the dot, beside "Kerberoasting"; ATT&CK technique IDs have four digits, so this is probably a typo for T1558.003 (this site's reading; the FLASH does not comment). The FLASH's summary says "from reconnaissance through data exfiltration", but the table has no row named Exfiltration: the nearest is "Collection / Exfiltration Prep".

The FLASH names seven overlooked attack surfaces, with endnote 1, Akamai (derived count, treating "partner and supplier portals" as one): partner and supplier portals, mobile backends, employee applications, sales-support systems, legacy services, third-party integrations, applications created across different business units. It says ARTEX "excels at identifying and exploiting peripheral systems receiving less security attention than flagship applications". That is a claim about what agents are good at. The FLASH gives no count of intrusions through such systems.

What the FLASH states, and what it does not

The count of 29 indicators is derived by this site (counting the lines after the header gives 31, two of which are not indicators). No address or domain in this briefing was visited, resolved or tested.

Where the sources differ

The FLASH, The Record, Amazon and Censys disagree, or are blurred, in several places. None is resolved here; the briefing follows the FLASH where it quotes it and says whose each other statement is.

Amazon's own post, saved here, describes decoy sensors that recorded requests from ARTEX agents between 3 October and 5 November, and says Amazon Threat Intelligence "did not observe that activity as it happened and cannot verify the outcomes the agents reported", and assesses "with moderate confidence" that ARTEX was used. Its 11 indicators are addresses (derived: 5 for one campaign and 6 for the other); none of them is among the FLASH's 24 (derived by string comparison). Of the FLASH's 24 addresses, 13 are also on the Censys page (derived). The Record is a secondary: it gives the FLASH a headline, attributes the 1,600 to Censys, and names the developer; this briefing uses it only where it differs or adds.

What to do, in order

What the FLASH gives a defender: the table, row by row

The FLASH prints real artifacts: a table of observed activity and ATT&CK techniques, a list of indicators and a list of recommendations. They are copied here as printed (the FLASH is TLP:CLEAR, which it says may be shared without restriction). Dashes the FLASH prints in technique names are written as hyphens, bullets are joined onto one line each, and the table's own line wraps are removed. This site adds no hunting queries and no detection rules of its own. A defender can use the rows to check which techniques a monitoring set covers; the FLASH does not say how often each was seen or by whom.

PHASE: Initial Recon
OBSERVED ACTIVITY
- Automatically mapped effective permissions of Azure credentials (SAS tokens, Service Principals, Kudu credentials, Storage Account keys) using sub-second capability checks, test blob writes/deletes, ARM deployment validation dry-runs
- Tested compromised IAM user permissions using DryRun flags
- Fuzzing web directories across 500+ requests
- WHOIS asset mapping and active vulnerability scanning
- Queried api.db-ip[.]com to determine victim geolocation
ATT&CK TECHNIQUES
T1595 - Active Scanning
T1580 - Cloud Infrastructure Discovery
T1087.004 - Account Discovery: Cloud Account
T1069.003 - Permission Groups Discovery: Cloud Groups
T1526 - Cloud Service Discovery

PHASE: Initial Access
OBSERVED ACTIVITY
- Exploited unsigned SAML assertions
- Exploited XXE flaws
- Exploited anonymous file upload
- Abused cross-account cloud trust relationships from an external partner tenant
- Compromised third-party vendor credentials to pivot via trusted B2B federation
- Exploited SSRF
- Hardcoded administrator passwords in SPA JavaScript bundles
- Missing authentication on Web APIs
- RCE through command injection
- Insecure Direct Object References (IDOR)
- Weak administrative credentials
- RCE through SSTI
- SQL injection
- Authentication bypass
- Used stolen VPN configurations and leaked credentials
ATT&CK TECHNIQUES
T1190 - Exploit Public-Facing Application
T1078 - Valid Accounts
T1133 - External Remote Services
T1195 - Supply Chain Compromise
T1199 - Trusted Relationship
T1606.002 - Forge Web Credentials: SAML Tokens
T1552.001 - Unsecured Credentials: Credentials in Files

PHASE: Establish Foothold / Persistence
OBSERVED ACTIVITY
- Deployed JSP and PHP web shells (including via MySQL log poisoning)
- Abused Kudu administrative APIs to execute arbitrary commands
- Established C2 on internal Windows database servers
- Installed open-source RATs (WISP, vshell, AdaptixC2)
- Created SSH key pairs, allocated Elastic IPs
- Account takeover (password resets)
- Added credentials to existing OAuth applications
ATT&CK TECHNIQUES
T1505.003 - Server Software Component: Web Shell
T1078.004 - Valid Accounts: Cloud Accounts
T1098.001 - Account Manipulation: Additional Cloud Credentials
T1574.001 - Hijack Execution Flow: DLL
T1036.005 - Masquerading
T1105 - Ingress Tool Transfer
T1059 - Command and Scripting Interpreter

PHASE: Privilege Escalation
OBSERVED ACTIVITY
- Launched cloud compute instances with high-value IAM roles
- Kerberoasting to harvest service tickets
- SQL injection to dump database credentials
- DCSync to steal domain krbtgt key
- Created accounts with is_admin=true flag
- Abused resource-based constrained delegation
- Queried cloud metadata service via XXE
- Forged administrator token using unrotated authentication keys
ATT&CK TECHNIQUES
T1134.001 - Access Token Manipulation
T1098.003 - Account Manipulation: Additional Cloud Roles
T1552.005 - Unsecured Credentials: Cloud Instance Metadata API
T1606.002 - Forge Web Credentials: SAML Tokens
T1606 - Forge Web Credentials
T1190 - Exploit Public-Facing Application
T11558.003 - Steal or Forge Kerberos Tickets: Kerberoasting

PHASE: Internal Recon
OBSERVED ACTIVITY
- Ran iterative PowerShell enumeration scripts against Domain Controllers
- Enumerated over 110,000 Active Directory objects
- Read LAPS passwords
- Inventoried endpoint sensor coverage to identify Windows machines without CrowdStrike Falcon
ATT&CK TECHNIQUES
T1518.001 - Software Discovery: Security Software Discovery
T1555 - Credentials from Password Stores
T1087.002 - Account Discovery: Domain Account
T1552.006 - Group Policy Preferences
T1059.001 - Command and Scripting Interpreter: PowerShell

PHASE: Lateral Movement
OBSERVED ACTIVITY
- Attempted lateral movement to domain controllers using Pass-the-Ticket, WinRM, Kerberos relay, Pass-the-Hash (blocked by endpoint protection)
ATT&CK TECHNIQUES
T1550.003 - Use Alternate Authentication Material: Pass the Ticket
T1550.002 - Use Alternate Authentication Material: Pass the Hash
T1021.006 - Remote Services: Windows Remote Management (WinRM)
T1557.001 - Adversary-in-the-Middle: LLMNR/NBT-NS Poisoning and SMB Relay

PHASE: Collection / Exfiltration Prep
OBSERVED ACTIVITY
- Interrogated backend SQL databases
- Mass blob reads
- Deployed custom boot scripts via EC2 instances to harvest data
- Sent command output to rotating webhook.site endpoints
- Read mailboxes on compromised mail server
- Created new 100GB volumes for exfiltration preparation
ATT&CK TECHNIQUES
T1114.002 - Email Collection: Remote Email Collection
T1555.006 - Cloud Secrets Management Stores
T1530 - Data from Cloud Storage
T1005 - Data from Local System
T1074.001 - Data Staged: Local Data Staging
T1074.002 - Data Staged: Remote Data Staging
T1059 - Command and Scripting Interpreter

PHASE: Command and Control
OBSERVED ACTIVITY
- Used residential proxy services
- Routed traffic through Tor, SOCKS proxies, compromised relays
- Tunneled traffic via Chisel and SoftEther
- BLOODALCHEMY communicated with C2 domains
ATT&CK TECHNIQUES
T1090 - Proxy
T1090.003 - Proxy: Multi-hop Proxy
T1572 - Protocol Tunneling
T1071.001 - Application Layer Protocol: Web Protocols

The indicators: 24 addresses, 1 domain, 4 hostnames

The CSV has 29 indicators, all counted by this site (derived): 24 addresses, 1 domain and 4 hostnames the file calls Outbound API calls. By endnote, 10 addresses rest on CrowdStrike (endnote 6; one also cites Censys), 6 on Microsoft's 21 October post (endnote 2) and 8 on Microsoft's November post (endnote 10): 10 + 6 + 8 = 24. Four network and behavioural indicators cite Zscaler (endnote 7). The FBI says to "investigate or vet IOCs prior to taking action, such as blocking". Defenders normally match addresses against historical flow and sign-in logs for the window in the context column, then investigate; they do not visit them. Every address and domain here is defanged with [.] and none was visited, resolved or tested.

38.244.50[.]120

144.172.64[.]60
144.172.64[.]99
144.172.64[.]128

187.15.88[.]186
187.15.90[.]217
187.15.89[.]186

101.53.80[.]20
205.214.59[.]31
124.155.252[.]63
154.201.79[.]246
23.248.249[.]90
23.158.220[.]98
103.248.148[.]84
203.160.133[.]172
209.209.85[.]38

199.19.95[.]66
199.19.95[.]67
199.19.95[.]68

91.92.240[.]238
85.11.168[.]45
178.16.54[.]129
31.77.229[.]35

85.11.167[.]52

The one domain is "LLM API reseller (South Korea financial campaign)", endnote 6: xcai[.]pro. The four hostnames below are listed in the CSV as indicators of type Outbound API calls and in the PDF as "investigate unexpected calls alongside other suspicious activity". They are the names of AI model services, which legitimate users also call, so a hit on them means a question, not a finding. This site defangs them here; the FLASH prints them plain.

xcai[.]pro

api[.]anthropic[.]com
api[.]deepseek[.]com
open[.]bigmodel[.]cn
api[.]x[.]ai

The FBI's recommendations, and whose they are

The FLASH lists 20 recommendations in four groups (derived count). Each carries an endnote, and none cites the FBI. By endnote: 9 rest on Microsoft's post of 21 October (endnote 2, mostly about Microsoft 365 and ConnectWise), 8 on Google and Mandiant's defensive post (endnote 5), 2 on Zscaler (endnote 7) and 1 on Akamai (endnotes 1 and 11): 9 + 8 + 2 + 1 = 20. The words are the FLASH's, copied as printed.

The question the FLASH leaves open

When a defender is told that some intrusions go from first contact to privileged access in under three hours, which of the 11 endnotes will let them see how many, on whose networks, and counted by whom, and which of those three words is the FBI's own?

Key facts