The actor and the capability
Microsoft Threat Intelligence has reported that Storm-0940, a threat actor with ties to China, has integrated an AI framework called ARTEX into its credential-spray and password-spray infrastructure. The actor focuses on government and defense-adjacent targets in North America and Europe. ARTEX automates target prioritization, rotates proxy infrastructure, and adapts request timing to evade rate-limiting controls. This is one of the first confirmed public disclosures of an advanced persistent threat actor deploying AI tooling operationally rather than as an internal capability under development.
How ARTEX works
Based on the Microsoft disclosure, ARTEX functions as an orchestration layer above existing credential-spray tooling. It ingests information about target authentication endpoints, analyzes results of previous spray attempts, and adjusts subsequent attempts to maximize success rates while staying below detection thresholds. The actor routes traffic through compromised small-office and home-office routers as operational relay infrastructure, obscuring the origin of attacks from IP-based detection and attribution.
Detection implications
AI-paced credential spray traffic may not trigger detection signatures tuned for human-speed or script-speed attack patterns. Traditional velocity anomaly thresholds assume relatively uniform or cyclical request rates. An AI system that adapts its timing based on authentication responses produces irregular, low-volume patterns that may fall well below static velocity thresholds. Attribution is also harder: AI-generated request patterns obscure the timing fingerprints analysts use to cluster activity across sessions.
What to do
The ARTEX disclosure warrants specific operational responses. Review velocity thresholds in authentication event monitoring: current thresholds may be calibrated for faster attack patterns and will miss low-and-slow adaptive spray. Audit use of small-office and home-office routers in organizational egress monitoring for anomalous authentication traffic. Treat AI-assisted credential spray as an active threat category in detection engineering planning. The fact that a tracked threat actor cluster is deploying AI operationally confirms this threat model has moved from theoretical to confirmed.
Gigia Tsiklauri is a Security Architect and founder of infosec.ge. She specializes in AI security, offensive security, and building security programs for fintech and banking organizations.