A security researcher has identified a large-scale effort to deploy offensive artificial intelligence agents across several virtual private server providers to build a distributed network for cyberattacks. Hundreds of instances of the ARTEX agentic AI framework have appeared on platforms including Cogent, ColoCrossing, DigitalOcean, Vultr and Linode. The researcher noted that the instances shared an identical ETag and Content-Length, indicating they were deployed from the same Docker image or template.
The mass deployment follows a campaign by China-linked hacking groups that used ARTEX to automate intrusions against Microsoft 365 tenants. Microsoft and CrowdStrike previously reported that the threat actors, tracked as Storm-0940 and Vapor Panda, used the tool to accelerate reconnaissance and privilege escalation, in some cases gaining cloud access in under 3 hours. The campaign targeted hundreds of global organizations by abusing credentials from an IT services firm, ConnectWise, allowing the attackers to bypass multi factor authentication.