Cybersecurity experts have observed a troubling trend: threat actors are increasingly weaponizing agentic frameworks to execute highly automated intrusions. In a report published in September 2026, the Google Threat Intelligence Group (GTIG) noted that adversaries were transitioning from basic prompting to agentic workflows and LLM-enabled automation. Since then, GTIG and Mandiant have documented multiple incidents where threat actors abused open-source pentesting frameworks like ARTEX, Hexstrike, and CAIRN to conduct a wide range of actions across various phases of the attack lifecycle.
The emergence of these frameworks marks a paradigm shift towards intrusions occurring at machine speed. While the mechanics of the intrusions remain similar, such as using compromised credentials and targeting unpatched systems, the speed and scale at which these frameworks can exploit known weaknesses present a new defensive challenge. Security teams, developers, and system administrators must rethink their defense strategies to counter scalable, autonomous software.
ARTEX, one of the most notable frameworks, is an autonomous, multi-agent LLM-driven pentesting and offensive command-and-control (C2) platform written in Go with an embedded Next.js web console. Originally developed by the user Autumn-27 and released on GitHub, the framework was taken down by its creator in October 2026 due to widespread abuse. However, it continues to proliferate globally via community forks, including localized variations like ScopeWeaver and a commercial version called ARTEX PRO.
Since late August 2026, ARTEX has been adopted by a diverse range of threat actors, including financially motivated extortion groups and suspected cyber espionage operators. For example, the Wiz Research team has been tracking a campaign associated with ARTEX, which GTIG tracks as UNC7228, overlapping with activity tracked by Microsoft as the PRC-nexus actor STORM-0940. This actor has targeted multiple entities in the US and Europe across various industry verticals, moving from initial compromise to deep system access in as little as 15 minutes.