Threat Summary
Three converging OTX pulses paint a picture of a threat landscape being reshaped by AI on both sides of the wire:
1. ARTEX: Agentic Asbestos (Storm-0940). ARTEX is an open-source, LLM-driven autonomous penetration testing framework released in July 2026. What began as red-team tooling has been operationalized by Storm-0940 against South Korean financial institutions. Censys internet scanning identified 1,465 exposed ARTEX consoles across ~815 distinct deployments — meaning the framework itself is now both an attack tool and an attack surface. Associated tooling includes Cobalt Strike (S0154), Vshell, and Adaptix C2, with indicators tied to ConnectWise compromise and exploitation of CVE-2021-3156 (Baron Samedit — sudo heap overflow). Tags referencing "llm agents," "cyberstrikeai," and "ai-driven attacks" confirm adversaries are delegating reconnaissance and exploitation decision-making to autonomous agents.
2. Blinder Tunnel (CL-STA-1178). An Iranian state-aligned cluster impersonating the Dubai Airports IT department to deliver trojanized coding challenges to engineers and developers at Iraqi critical infrastructure organizations (energy and government sectors), with secondary targeting in Israel. Active since November 2025 and intensifying in March 2026, the campaign uses a three-stage chain: ShelbyLoader V2 → DLL side-loading payloads (RuntimeBroker.dll, PsProxy.dll, Blackwood.dll) via AppDomainManager hijacking → Chisel-based tunneling with GitHub abused as a C2/dead-drop channel.
3. Langflow Mass Exploitation. F5 Labs recorded 405 exploitation attempts from 55 distinct IPs in September 2026 targeting CVE-2026-0768, an unauthenticated RCE in the Langflow AI application-building platform — the first observed instance of an AI/ML development platform RCE appearing in opportunistic internet-wide scanning. Payloads included capability probing and credential harvesting. The same scanning waves attempted legacy CVEs (CVE-2021-26855 ProxyLogon, CVE-2022-41082 ProxyNotShell, CVE-2021-3156, CVE-2024-4577 PHP-CGI), indicating exploitation framework reuse.
Collective signal: AI development platforms are now both weapons (ARTEX autonomous attack agents) and targets (Langflow RCE scanning), while state-aligned actors continue social-engineering developer communities — the people with keys to critical infrastructure.
Threat Actor / Malware Profile
Storm-0940 / ARTEX Toolchain
- Distribution: ARTEX consoles exposed to the internet (default web interfaces); ConnectWise ScreenConnect compromise as an initial-access and lateral movement vector.
- Payload behavior: LLM agents autonomously chain reconnaissance (port/service enumeration), vulnerability selection, and exploitation. Human operators supervise rather than drive individual actions, dramatically compressing time-to-compromise.
- Post-exploitation: Cobalt Strike beacons, Vshell (Go-based cross-platform RAT popular with Chinese-nexus actors), and Adaptix C2 (open-source C2 framework gaining adoption as a Cobalt Strike substitute).
- Privilege escalation: CVE-2021-3156 (sudo Baron Samedit) for root on Linux targets.
CL-STA-1178 / ShelbyLoader V2 + Blinder Tunnel
- Distribution: Spear-phishing impersonating Dubai Airports IT recruitment, delivering trojanized "coding challenges" — a lure engineered to reach developers and DevOps staff with elevated infrastructure access.
- Payload behavior: ShelbyLoader V2 stages secondary payloads. RuntimeBroker.dll, PsProxy.dll, and Blackwood.dll are side-loaded by legitimate signed executables; AppDomainManager hijacking executes managed payloads when .NET applications launch.
- C2 communication: Chisel (Go TCP/UDP tunnel over HTTP, with SSH-style tunneling) provides the "Blinder Tunnel." GitHub repositories are abused as C2 infrastructure and dead drops, blending with legitimate developer traffic.
- Persistence & stealth: AppDomainManager hijack persists via configuration file placement alongside trusted .NET executables; DLL side-loading evades application allowlisting and signature-based controls.
- Objective: Long-term espionage and pre-positioning within Iraqi energy and government networks.
Langflow Exploitation Wave
- Distribution: Opportunistic internet-wide scanning for CVE-2026-0768 (unauthenticated RCE).
- Payload behavior: Capability probing (unique per-probe tokens to confirm execution), followed by credential harvesting — AI platform environments hold API keys for LLM providers, vector databases, and internal data connectors, making them high-value credential stores.
IOC Analysis
The pulses contain three operational indicator classes:
- IPv4 (ARTEX/Storm-0940):
45.87.53.6,38.244.50.120,124.155.252.63,23.248.249.90,23.158.220.98,103.248.148.84,203.160.133.172— C2 and staging infrastructure for Adaptix/Vshell/Cobalt Strike. Push to firewall, proxy, and EDR network block lists; retro-search NetFlow/proxy logs for 90 days. - FileHash-SHA256 (Blinder Tunnel): 30 hashes covering ShelbyLoader V2 and the side-loaded DLLs. Import into your EDR blocklist and run retroactive hunts — hash-based detection catches the loader stage even when final payloads are polymorphic. Note: attacker-controlled GitHub C2 content rotates hashes, so pair hash blocking with behavioral rules below.
- CVEs (Langflow wave): CVE-2026-0768 is the priority; the legacy CVE set (ProxyLogon, ProxyNotShell, CVE-2024-4577, CVE-2018-20062, CVE-2017-9841) maps the scanners' exploitation framework — if you see one of these older exploits in WAF logs, expect Langflow probing from the same source.
Operationalization: ingest indicators via TAXII/STIX into your SIEM, set IP indicators to both block and alert (Adaptix C2 commonly reuses residential-adjacent hosting), and treat GitHub-abuse C2 as a behavioral problem — you cannot block github.com, so detect anomalous git/HTTPS patterns from non-developer hosts instead.
Detection Engineering
YAML
---
title: AppDomainManager Hijacking - Configuration File Creation
description: Detects creation of .config files referencing AppDomainManager alongside legitimate executables, a technique used by CL-STA-1178 (ShelbyLoader V2 / Blackwood.dll) for managed payload execution
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
category: file_event
product: windows
detection:
selection_extension:
TargetFilename|endswith: '.exe.config'
selection_content:
TargetFilename|contains: 'AppDomainManager'
filter_legitimate_paths:
TargetFilename|startswith:
- 'C:\Program Files\Microsoft Visual Studio\'
- 'C:\Program Files (x86)\Microsoft Visual Studio\'
condition: selection_extension and selection_content and not filter_legitimate_paths
falsepositives:
- Developer workstations with legitimate custom AppDomainManager assemblies
level: high
tags:
- attack.persistence
- attack.t1574.002
---
title: Chisel Tunnel Execution - Blinder Tunnel Campaign
description: Detects execution of Chisel tunneling client used by CL-STA-1178 for C2 tunneling into Iraqi critical infrastructure networks
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: '\chisel.exe'
- OriginalFileName: 'chisel.exe'
selection_cli:
CommandLine|contains:
- 'client --fingerprint'
- 'R:socks'
- 'server --socks5'
- ' client '
- ' --reverse '
condition: selection_img or selection_cli
falsepositives:
- Penetration testing activity
- Legitimate tunneling by network administrators (rare)
level: high
tags:
- attack.command_and_control
- attack.t1090
- attack.t1572
---
title: Adaptix or Vshell C2 Network Beaconing to Known Storm-0940 Infrastructure
description: Detects outbound connections to Storm-0940 ARTEX campaign C2 infrastructure associated with Adaptix C2, Vshell, and Cobalt Strike deployments against South Korean financial targets
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
category: network_connection
product: windows
detection:
selection_dst:
DestinationIp:
- '45.87.53.6'
- '38.244.50.120'
- '124.155.252.63'
- '23.248.249.90'
- '23.158.220.98'
- '103.248.148.84'
- '203.160.133.172'
condition: selection_dst
falsepositives:
- None expected; these IPs are dedicated adversary infrastructure
level: critical
tags:
- attack.command_and_control
- attack.t1071
KQL — Microsoft Sentinel / Defender
// Hunt: Blinder Tunnel (CL-STA-1178) side-loaded DLLs + Storm-0940 C2 + GitHub C2 abuse
// Microsoft Sentinel / Defender XDR
let C2_IPs = dynamic(["45.87.53.6","38.244.50.120","124.155.252.63","23.248.249.90","23.158.220.98","103.248.148.84","203.160.133.172"]);
let LoaderHashes = dynamic(["6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239","f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9","53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402","3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13","76273382e4252c1f60a2251141e108942494409c759358320735891762c0682e","d3561bd4aad003dc3e08157b0891860bb496b80cd6e44901692e08ab1d4e8260","f5ba1645694c62f527ed6ceda8c68a5c3dd92b4032439167e8e937e72803b4bd","7cc571aca6d8715d9aaad3d83e1bcd30467565d583db1dfe73697c5d00a1f875"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(90d)
| where RemoteIP in~ (C2_IPs)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, ActionType
| extend DetectionType = "Storm-0940 C2 Connection"),
(DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where SHA256 in~ (LoaderHashes)
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, ProcessCommandLine, InitiatingProcessFileName
| extend DetectionType = "ShelbyLoader V2 Hash Match"),
(DeviceImageLoadEvents
| where TimeGenerated > ago(90d)
| where FileName in~ ("RuntimeBroker.dll","PsProxy.dll","Blackwood.dll")
| where FolderPath !startswith "C:\\Windows\\System32" and FolderPath !startswith "C:\\Windows\\SysWOW64"
| project TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| extend DetectionType = "Side-loaded DLL from Non-System Path"),
(DeviceProcessEvents
| where TimeGenerated > ago(90d)
| where (FileName =~ "chisel.exe" or ProcessCommandLine has_any ("R:socks","client --fingerprint","server --socks5"))
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessAccountName
| extend DetectionType = "Chisel Tunnel Execution"),
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl has_any ("github.com","raw.githubusercontent.com","api.github.com")
| where InitiatingProcessFileName !in~ ("git.exe","githubdesktop.exe","code.exe","devenv.exe","curl.exe","node.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP
| extend DetectionType = "Suspicious Non-Developer Process to GitHub (Possible C2)")
| sort by TimeGenerated desc
PowerShell
# Security Arsenal - Combined IOC Hunt: Storm-0940 ARTEX + CL-STA-1178 Blinder Tunnel + Langflow artifacts
# Run elevated on endpoints; output CSV per host for SIEM ingestion.
$ErrorActionPreference = 'SilentlyContinue'
$Results = @()
# --- 1. Network connections to Storm-0940 / ARTEX C2 infrastructure ---
$C2IPs = @('45.87.53.6','38.244.50.120','124.155.252.63','23.248.249.90','23.158.220.98','103.248.148.84','203.160.133.172')
Get-NetTCPConnection | Where-Object { $C2IPs -contains $_.RemoteAddress } | ForEach-Object {
$proc = Get-Process -Id $_.OwningProcess
$Results += [PSCustomObject]@{Type='C2-Connection'; Detail="$($_.RemoteAddress):$($_.RemotePort) via $($proc.ProcessName) (PID $($_.OwningProcess))"; Severity='CRITICAL'}
}
# --- 2. ShelbyLoader V2 / Blinder Tunnel file hashes on disk ---
$Hashes = @('6e7d9b33f1e72ea1ede71373a604ecdb060dab7d42055179c1eede9ecd1fd239','f5b12772db6817f7a765a6fe7565fd3d4f87edc28e42fe3ec0244a372a410fc9','53f35e49eb9b271fd8cbcd3daacb525328dbf159a03dbd1c7adebe0363daa402','3fd810a3aa0039993393741b32287c367a9a5037a41e826906440887cdd3ed13','76273382e4252c1f60a2251141e108942494409c759358320735891762c0682e','d3561bd4aad003dc3e08157b0891860bb496b80cd6e44901692e08ab1d4e8260','f5ba1645694c62f527ed6ceda8c68a5c3dd92b4032439167e8e937e72803b4bd','7cc571aca6d8715d9aaad3d83e1bcd30467565d583db1dfe73697c5d00a1f875')
$SearchPaths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","$env:USERPROFILE\Downloads","C:\ProgramData","C:\Users\Public")
foreach ($p in $SearchPaths) {
Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
$h = (Get-FileHash -Path $_.FullName -Algorithm SHA256).Hash.ToLower()
if ($Hashes -contains $h) { $Results += [PSCustomObject]@{Type='Malware-Hash'; Detail="$($_.FullName) [$h]"; Severity='CRITICAL'} }
}
}
# --- 3. Side-loaded DLLs in non-system locations ---
$SideloadNames = @('RuntimeBroker.dll','PsProxy.dll','Blackwood.dll')
foreach ($p in $SearchPaths + @("C:\Program Files","C:\Program Files (x86)")) {
foreach ($n in $SideloadNames) {
Get-ChildItem -Path $p -Recurse -Filter $n -ErrorAction SilentlyContinue | ForEach-Object {
$Results += [PSCustomObject]@{Type='Sideload-DLL'; Detail=$_.FullName; Severity='HIGH'}
}
}
}
# --- 4. AppDomainManager hijack artifacts (.exe.config referencing AppDomainManager) ---
foreach ($p in $SearchPaths) {
Get-ChildItem -Path $p -Recurse -Filter '*.exe.config' -ErrorAction SilentlyContinue | ForEach-Object {
if ((Get-Content $_.FullName -Raw) -match 'AppDomainManager') {
$Results += [PSCustomObject]@{Type='AppDomainManager-Hijack'; Detail=$_.FullName; Severity='HIGH'}
}
}
}
# --- 5. Chisel tunnel artifacts ---
Get-Process | Where-Object { $_.ProcessName -match 'chisel' } | ForEach-Object {
$Results += [PSCustomObject]@{Type='Chisel-Process'; Detail="PID $($_.Id) - $($_.Path)"; Severity='HIGH'}
}
Get-ChildItem -Path $SearchPaths -Recurse -Filter 'chisel*' -ErrorAction SilentlyContinue | ForEach-Object {
$Results += [PSCustomObject]@{Type='Chisel-Binary'; Detail=$_.FullName; Severity='HIGH'}
}
# --- 6. ARTEX console artifacts & Adaptix/Vshell persistence (run keys, scheduled tasks, services) ---
$RunKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($rk in $RunKeys) {
Get-ItemProperty -Path $rk | ForEach-Object {
$_.PSObject.Properties | Where-Object { $_.Value -match 'vshell|adaptix|artex|beacon' } | ForEach-Object {
$Results += [PSCustomObject]@{Type='Suspicious-RunKey'; Detail="$rk -> $($_.Name) = $($_.Value)"; Severity='HIGH'}
}
}
}
Get-ScheduledTask | Where-Object { $_.Actions.Execute -match 'vshell|adaptix|chisel' -or $_.TaskName -match 'vshell|adaptix' } | ForEach-Object {
$Results += [PSCustomObject]@{Type='Suspicious-Task'; Detail="$($_.TaskName): $($_.Actions.Execute)"; Severity='HIGH'}
}
# --- 7. Langflow exposure check (local service + recent suspicious child processes of python) ---
Get-NetTCPConnection -LocalPort 7860 -State Listen -ErrorAction SilentlyContinue | ForEach-Object {
$Results += [PSCustomObject]@{Type='Langflow-Exposed'; Detail="Port 7860 listening (PID $($_.OwningProcess)) - verify CVE-2026-0768 patch"; Severity='MEDIUM'}
}
Get-CimInstance Win32_Process | Where-Object { $_.Name -match 'python' -and $_.CommandLine -match 'langflow' } | ForEach-Object {
$parent = Get-CimInstance Win32_Process -Filter "ProcessId=$($_.ParentProcessId)"
$Results += [PSCustomObject]@{Type='Langflow-Process'; Detail="PID $($_.ProcessId), Parent: $($parent.Name)"; Severity='INFO'}
}
# --- 8. CVE-2021-3156 (sudo) check for Linux-side ARTEX escalation if WSL present ---
if (Get-Command wsl.exe -ErrorAction SilentlyContinue) {
$sudoVer = wsl sudo -V 2>$null | Select-Object -First 1
if ($sudoVer -match 'Sudo version 1\.(8\.[0-9]|9\.[0-4])') {
$Results += [PSCustomObject]@{Type='Vulnerable-Sudo'; Detail="WSL sudo potentially vulnerable to CVE-2021-3156: $sudoVer"; Severity='MEDIUM'}
}
}
$Results | Sort-Object Severity | Format-Table -AutoSize
$Results | Export-Csv -Path ".\IOC_Hunt_$(hostname)_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($Results.Count) findings exported."
Response Priorities
Immediate (0-4 hours)
- Block all seven Storm-0940 C2 IPs at perimeter firewall, proxy, and EDR network controls; alert on any historical hits in the last 90 days.
- Push the eight ShelbyLoader V2 SHA256 hashes into EDR block policy and trigger fleet-wide retro hunts.
- Audit for exposed ARTEX consoles in your environment and any ConnectWise ScreenConnect instances — verify version and restrict to VPN/allowlist access only.
- Identify any Langflow deployments (port 7860, container registries, developer workstations); if internet-facing and unpatched against CVE-2026-0768, take offline or isolate immediately.
- Alert on the trojanized coding-challenge lure: flag inbound emails claiming to be from Dubai Airports IT/HR containing project archives, GitHub links, or "skills assessment" attachments.
24 Hours
- Credential verification: both the Langflow wave (explicit credential harvesting) and CL-STA-1178 developer targeting put identities at risk. Force rotation of LLM provider API keys, cloud credentials, and secrets stored in Langflow/AI platform environments. Review sign-in logs for developer and DevOps accounts at targeted organizations for impossible travel and anomalous MFA prompts.
- Hunt GitHub-bound traffic from non-developer processes (KQL above) — GitHub-as-C2 defeats domain blocking, so behavioral detection is the control.
- Review WAF/load balancer logs for exploitation attempts against the legacy CVE set (ProxyLogon, ProxyNotShell, CVE-2024-4577) — same scanner infrastructure is probing Langflow.
- Verify EDR visibility into DLL load events (ImageLoad) — required to catch side-loaded RuntimeBroker.dll/PsProxy.dll/Blackwood.dll from non-system paths.
1 Week
- Architecture hardening for AI platforms: move all AI/ML development tooling (Langflow, ARTEX, Jupyter, MLflow) behind authenticated gateways; prohibit internet exposure by policy and enforce via continuous external attack surface monitoring.
- Implement application control policies flagging .exe.config files with AppDomainManager entries outside Visual Studio directories.
- Segment developer workstations from production critical infrastructure management networks — the Blinder Tunnel campaign specifically exploits developer trust relationships.
- Patch CVE-2021-3156 (sudo) across Linux estates; ARTEX's autonomous exploitation chains will weaponize any unpatched local privilege escalation.
- Establish detections for autonomous-agent behavior patterns: rapid sequential reconnaissance, exploitation attempts across multiple CVE classes from a single source, and machine-speed decision intervals that distinguish ARTEX-style LLM agents from human operators.
- Brief finance-sector and critical-infrastructure business units on both campaigns; run a targeted phishing simulation using the coding-challenge lure format.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.