TOPIC
How ARTEX is reused across distinct actor/campaign clusters; actor aliases, infrastructure provenance and temporal correlation without treating shared tooling, IPs, language or geography as identity proof.
1
7
5
10
3
NEW — multi-actor ARTEX diffusion verified; VAPOR PANDA explicitly separate from Storm-0940; unattributed South Korea cluster preserved; shared-IP attribution caveat established. TAI canonical/domain-local/global Hot-Start readback PASS after foreign CSS owner repaired its malformed Run identity.
THREAT_ACTOR_INFRASTRUCTURE_RESEARCH_TOPIC
—
—
—
ARTEX has become a shared offensive orchestration layer used by multiple distinct actor/campaign identities; ARTEX presence is not a reliable actor identifier.
Broader actor/fork denominator and independent cross-vendor identity graph.
ARTEX-related operations increasingly use replaceable controllers, rotating IPs/proxies and multiple backends, reducing standalone static-IOC value and increasing temporal-correlation value.
Passive DNS/RDAP/cert/provider telemetry with first/last-seen and control evidence.
The Oct-17 VAPOR PANDA ARTEX operation is analytically distinct from Storm-0940 despite shared ARTEX use and includes campaign-specific BLOODALCHEMY C2 infrastructure.
مرجع SSOT مسجل، لكن الرابط الداخلي مخفي حتى تفعيل حماية Admin.
Related Topics
الإجمالي: 7 Evidence
Multiple distinct threat actors used ARTEX/agentic offensive frameworks in real IR engagements; forks/variants persisted after original ARTEX repository removal.
لا يثبت: Does not establish one shared actor/operator or complete actor/victim denominator.
One ARTEX controller targeted 200+ organizations across at least 14 countries; post-exploitation confirmed at nine; BLOODALCHEMY C2 recovered; campaign explicitly separate from Storm-0940.
لا يثبت: Does not prove compromise of all targets or identity equivalence with Storm-0940.
38.244.50[.]120 hosted ARTEX; two-server/proxy architecture recovered. Actor remained unnamed; Chinese-speaking/financial motive only moderate confidence.
لا يثبت: Language/tool origin/geography/prompt details do not establish a named actor.
Microsoft assesses Storm-0940 used ARTEX globally; 144.172.64[.]99/.60/.128 linked to spraying and downstream application abuse; >2,250 tenants attempted.
لا يثبت: Affected app/authentication does not necessarily prove data access; IP overlap cannot transfer attribution to unrelated activity.
Wiz tracked an ARTEX-using actor targeting IT/software vendors and identity providers, described as overlapping with Storm-0940; rapid IP rotation/open-proxy fallback observed.
لا يثبت: Vendor-stated overlap is not universal identity equivalence for every event/IP.
Expel observed 144.172.64[.]99 abusing Okta self-registration but says shared IP is its only link to Storm-0940 and activity alone does not prove ARTEX use.
لا يثبت: Does not prove Storm-0940 operator identity or ARTEX use for that Okta activity.
Microsoft reports Onyx Sleet and Pearl Sleet leveraging ARTEX since late October, independently demonstrating adoption outside Storm-0940/VAPOR PANDA clusters.
لا يثبت: Does not link DPRK infrastructure/victims/campaigns to PRC-nexus or unattributed ARTEX activity.
Independent corroboration of VAPOR PANDA actor mapping and infrastructure control.
Vendor actor overlap and shared infrastructure must remain provenance-tagged relations rather than automatic identity merges; IP-only overlap is insufficient to propagate Storm-0940 attribution.
Cross-vendor mapping with shared event artifacts or time-bounded infrastructure control.
AI-provider credentials and other high-value environment-variable secrets are active monetization targets in the 2026 developer-platform threat ecosystem; downstream LLMJacking and credential resale create incentives for repeated platform-focused intrusion.
Broader provider telemetry, normalized incident denominator and actor/infrastructure lineage
The Northflank incident is operationally linked to the same actor or campaign responsible for multiple other October 2026 developer-platform compromises.
Actor-linked infrastructure, access artifacts, credential-use chronology or authoritative cross-incident attribution
AI/agentic tooling can compress reconnaissance/exploitation tempo in observed financial intrusions, but public evidence does not justify attributing all NBFC payment-API thefts to ARTEX, CyberStrike or one operator.
Incident-specific agent logs, controller infrastructure, session artifacts and independent attribution.
Multiple intrusion/credential actors can feed an overlapping market for stolen AI credentials; target/economic convergence is stronger than single-actor intrusion convergence.
Credential lineage and authoritative actor crosswalk.
Stolen AI credentials can be loot, third-party compute and operational cover; AI/tool presence does not establish common actor identity or universal efficacy uplift.
Provider actor/credential lineage and controlled efficacy baselines.
Shared/overlapping stolen-AI-credential validation/resale infrastructure is better supported than one actor behind all platform incidents.
Time-bounded infrastructure control, credential provenance, shared artifacts or authoritative attribution.
Independent cross-vendor identity resolution is incomplete across GTIG UNC7228, Microsoft Storm-0940, Wiz overlap labels, CrowdStrike VAPOR PANDA and unattributed ARTEX clusters.
Independent shared victim/event artifacts, infrastructure-control evidence, malware/tooling lineage and provider telemetry with time correlation.
Public evidence does not fully resolve ownership/control, compromise state and first/last-seen continuity for ARTEX controllers, proxies and campaign C2 across clusters.
Passive DNS, RDAP/WHOIS history, CT, provider logs and time-bounded controller artifacts.
No reliable denominator establishes total distinct ARTEX operators, forks/controllers, successful victims or currently active infrastructure after rapid proliferation.
Multi-provider telemetry, fork lineage, controller fingerprints, independent victim counts and longitudinal infrastructure observations.
ARMORY CASTLE/UNC5221/WARP PANDA attribution is source-qualified but independent public forensic attribution beyond coordinated incident evidence is limited.
Separate authoritative/provider attribution with actor-linked infrastructure/malware/operational artifacts.
Current evidence does not safely resolve whether Northflank and other October developer-platform incidents share one actor/campaign or only a common monetization/targeting pattern.
Shared infrastructure with temporal control, common payload/access artifacts, credential-use graph and authoritative attribution.
ECOSYSTEM_DENOMINATOR