FBI Warns 10 Critical Sectors of AI-Powered Cyberattacks

USA – Financial institutions, government agencies, defense contractors, energy companies, hospitals, telecommunications providers, and other major industries are being warned to watch for a new generation of cyberattacks powered by artificial intelligence. The FBI says malicious actors are using an automated hacking framework called ARTEX to identify vulnerabilities, break into computer networks, steal credentials, and gain access to sensitive information at speeds that can leave security teams struggling to respond.

The FBI’s Cyber Division, led by Assistant Director Brett Leatherman, issued the November 13 intelligence bulletin warning that malicious actors are using ARTEX to target organizations across ten major industry sectors: financial services, government, technology, defense, semiconductors, energy, healthcare, manufacturing, telecommunications, and legal services.

This is not simply a warning about what artificial intelligence might do someday. The FBI is reporting actual campaigns, identified attack methods, compromised organizations, and infrastructure associated with malicious activity.

And the speed is alarming. Some reported intrusions progressed from initial targeting to privileged network access in less than three hours.

What Is ARTEX?

ARTEX is an open-source, artificial intelligence-driven penetration testing framework. Penetration testing is a legitimate cybersecurity practice in which authorized professionals attempt to break into computer systems to identify weaknesses before criminals can exploit them.

ARTEX takes that concept further by using autonomous software agents to perform much of the work. An operator can provide a general objective in ordinary language, and the software translates those instructions into computer commands, directing specialized agents to search for weaknesses, test credentials, and attempt access.

ARTEX does not contain its own artificial intelligence model. Instead, it connects to outside models, including OpenAI’s GPT, Anthropic’s Claude, DeepSeek, Grok, and other systems identified in the FBI report.

The danger is not that these companies necessarily participated in or authorized the attacks. The danger is that criminals can use available AI models as the intelligence behind automated hacking operations.

The Attacks Are Already Happening

The FBI’s warning follows several documented campaigns.

One financially motivated campaign against South Korean financial institutions resulted in the theft of personal information belonging to approximately 67,000 individuals, according to the FBI bulletin.

Another campaign involved ConnectWise Cloud Backup, a service used by businesses to protect their data. Attackers exploited a supply-chain weakness involving trusted software connections, subsequently using ARTEX to accelerate attempts against more than 2,250 downstream customer environments.

Microsoft Security Research reported October 21 that a China-aligned threat actor known as Storm-0940 used ARTEX to automate attacks against hundreds of organizations worldwide. Microsoft documented more than 151,000 failed sign-in attempts involving 327 accounts across eight organizations during one related password-spraying campaign. Microsoft said that particular campaign did not produce successful authentication, despite its enormous volume. Other related activity did result in privileged access at multiple organizations.

The findings illustrate how attackers can use legitimate connections between vendors and customers to reach organizations that might otherwise have stronger security defenses.

Government and Critical Infrastructure Are in the Crosshairs

The sectors identified by the FBI represent much more than a collection of corporate interests.

Financial institutions hold banking records, financial transactions, and personal identifying information. Government agencies maintain sensitive public records and information concerning national security. Defense contractors frequently possess information connected to military operations and government procurement..

Energy providers, telecommunications companies, and semiconductor manufacturers support infrastructure that modern American life depends upon. Healthcare organizations maintain medical records and other highly personal information, while manufacturers and law firms hold valuable commercial, intellectual property, and legal records.

A successful intrusion could expose information, disrupt operations, or provide attackers with access to other connected organizations. The FBI specifically warns that ARTEX is effective at finding overlooked systems, including supplier portals, employee applications, older software, and third-party integrations.

Google’s Threat Intelligence Group and Mandiant reported October 30 that multiple threat actors had been using ARTEX and other autonomous penetration-testing frameworks in actual intrusions. Their research identified activity affecting organizations in government, technology, manufacturing, and other industries.

Removing ARTEX Hasn’t Solved the Problem

ARTEX originally appeared on GitHub in July 2026 under the developer name Autumn-27. Following reports of criminal abuse, the developer removed the public repository on October 8.

That action did not eliminate the threat. Copies, modified versions, community-developed variations, and a commercial product called ARTEX PRO remain available.

The FBI reported that researchers had identified more than 1,600 publicly exposed ARTEX console installations by early November. The actual number could be considerably higher when privately operated systems are included.

The FBI recommends that organizations review their internet-facing applications, strengthen account security, limit administrative privileges, monitor unusual login activity, and examine connections with third-party vendors.

For organizations that suspect an intrusion, the FBI encourages reporting through local FBI field offices or the Internet Crime Complaint Center at IC3.gov.

The Warning Should Not Be Ignored

There is no evidence in the FBI bulletin that every organization in these ten sectors has been compromised, nor does the report identify a specific impending attack against a named Texas utility, hospital, bank, or government agency.

But the documented campaigns demonstrate that attackers are already using AI to accelerate intrusions against organizations across the global economy.

For Americans, the concern extends beyond stolen passwords or compromised corporate databases. Financial records, medical information, government operations, energy infrastructure, and communications networks all depend on the security of systems increasingly connected to one another.

Artificial intelligence is making it easier for criminals to operate at a scale previously requiring considerably more manpower and technical expertise. The FBI has now identified the threat and named the industries being targeted.

The question is whether the organizations responsible for protecting those industries are paying attention.

---

Questions & Answers

1. Which industries does the FBI warn are being targeted by ARTEX cyberattacks?

The FBI identifies financial services, government, technology, defense, semiconductors, energy, healthcare, manufacturing, telecommunications, and legal services as sectors targeted by ARTEX-related campaigns worldwide.

2. What specific cyberattacks have been linked to ARTEX?

The FBI reports a South Korean financial-sector campaign that exposed personal information belonging to approximately 67,000 individuals and a ConnectWise Cloud Backup supply-chain compromise involving more than 2,250 downstream customer environments. Microsoft also documented ARTEX-enabled attacks associated with the China-aligned Storm-0940 threat actor.

3. Is ARTEX targeting American government agencies and critical infrastructure?

Cybersecurity researchers have documented ARTEX-related activity involving U.S. organizations and multiple sensitive industries. However, the FBI’s November 13 bulletin does not identify a specific American government agency or Texas critical infrastructure facility as an imminent target.

4. What should organizations do to protect themselves from ARTEX?

The FBI recommends reviewing internet-facing applications, strengthening authentication, restricting administrative privileges, monitoring suspicious account activity, and examining third-party software and vendor connections. Organizations should preserve security logs and report suspected incidents to the FBI.

5. What are the sources for the FBI’s ARTEX warning and related investigations?

The primary source is FBI FLASH-20261113-001, dated November 13, 2026. Additional reporting and technical research include:

• Microsoft Security Research, October 21, 2026 — Storm-0940 and the ConnectWise supply-chain compromise.
• Google Threat Intelligence Group and Mandiant, October 30, 2026 — ARTEX and other autonomous offensive frameworks.
• BleepingComputer, November 2, 2026 — ARTEX campaigns targeting more than 200 organizations.
• Retail and Hospitality ISAC, November 4, 2026 — Additional global campaigns and affected industries.
• CERT-EU, November 5, 2026 — European cybersecurity assessment of ARTEX.

---

Related government announcements: President Trump’s AI task force discussed AI-powered cyberattacks and critical infrastructure reporting on November 12, according to Reuters’ November 13 report. I did not find a dedicated FBI speech or public service announcement specifically about ARTEX; the November 13 FLASH bulletin is the principal federal warning on this framework.