Snippet · Nov 5, 2026

ARTEX: A Family, Not a Tool

ARTEX is one of the biggest names in agentic attacks.

GTIG, Microsoft, CrowdStrike, Unit 42, and AhnLab have all documented ARTEX’s emergence in real intrusions. Throughout Black October and beyond, companies have begun directly linking ARTEX to their incidents.¹

ARTEX isn’t a monolithic tool. On October 8th, its author took ARTEX closed source. Meanwhile, direct forks, forked descendants (like ScopeWeaver), and even backdoored copies have proliferated.

The branches share code, swap TTPs, and muddy attribution.

ARTEX is only one of the many agentic attack(er) tools cropping up.²

1. Don’t overrotate to the tool. Defend against the pattern: agentic frameworks running real intrusions.
2. When you hear “ARTEX,” think family, not tool.

1. Kernel, WorkOS ↩

2. Hermes, Strix, Shannon, PentestGPT, Cairn, Hexstrike AI, PentAGI, CyberStrikeAI, Phantom, aiscan, and more ↩

If you found this useful, I aspire to send out new posts and ideas.