FBI warns of AI attack tool ARTEX: what small businesses should check
An FBI alert of November 13 describes ARTEX, an AI tool that automates attacks and was used to reach Microsoft 365 tenants through a backup app. What to check.
On November 13, 2026, the FBI published a FLASH alert about ARTEX, an AI-driven tool that criminals and state-backed groups are using to automate cyberattacks. Most of the detail is written for large security teams, but two parts of it apply directly to small businesses: attackers are going after the forgotten systems around the edge of an organization, and they are abusing apps that have been given access to Microsoft 365. Here is a plain-language summary and a short checklist.
What the FBI says
According to the FBI FLASH (FLASH-20261113-001), ARTEX is an open-source framework that connects to large language models and turns a goal typed in plain English into a series of attack commands. It was released in July 2026 as a penetration testing tool, and the FBI says malicious actors have used it since at least August 2026 against organizations in finance, government, healthcare, manufacturing, legal and other sectors. The original developer took the project offline in October, but copies and forks are still circulating, and researchers counted more than 1,600 exposed ARTEX consoles in early November.
The FBI highlights three things. Some intrusions went from first contact to privileged access in under three hours. The tool is good at finding side systems that get less attention, such as partner portals, legacy services and third-party integrations. And it lowers the skill needed to run complex attacks, so small groups can target many organizations at once.
The Microsoft 365 connection
The FBI cites a supply chain compromise affecting ConnectWise Cloud Backup customers that, in its words, enabled access to more than 2,250 downstream tenants. Microsoft's security blog described that campaign on October 21, 2026, attributing it to a group it tracks as Storm-0940. The attackers took over cloud application identities belonging to the backup service and used them to sign in to customer Microsoft 365 environments as an app, with no user typing a password and no multi-factor prompt to stop them.
That is the lesson for small firms. Every third-party app you approve in Microsoft 365, whether for backup, email signatures, scheduling or a CRM, holds a standing key to your data. If the vendor is compromised, that key can be used against you.
What a small business should do
- Ask whether ConnectWise Cloud Backup was ever used. Many businesses got it through an IT provider without knowing the name. The FBI advises reviewing every Microsoft 365 tenant where the affected ConnectWise apps are or were installed, even if the integration is no longer in use, and keeping those connections disabled until ConnectWise gives restoration instructions.
- Review your Enterprise applications. In the Microsoft Entra admin center, list the apps with access to your tenant, what permissions each has and who approved it. Remove the ones nobody uses, but save the details first: the FBI warns against deleting apps as a first response, because that can destroy evidence.
- Stop staff approving apps on their own. Set Microsoft 365 so that new app consent requests go to an administrator.
- List what you expose to the internet. Remote desktop, an old staff portal, a NAS login page, a VPN: these are the edges AI-assisted attacks probe first. Close what you do not need and keep the rest updated.
- Keep your logs. Make sure sign-in and audit logs are retained long enough to investigate, and that someone actually looks at alerts.
The FBI asks organizations that spot suspicious activity to contact their local FBI field office and report it at ic3.gov.
How we can help
Our cybersecurity team can review the apps connected to your Microsoft 365 tenant and tighten consent settings, and our managed IT services include ongoing monitoring of sign-ins. For a related risk, see our earlier article on token replay attacks against Microsoft 365. Call (213) 986-4855.