ARTEX is an AI-native penetration framework observed in October 2026 targeting AWS environments, focusing on financial data. It uses autonomous LLM agents to plan and execute attacks, exploiting compromised long-term IAM access keys to search CloudWatch logs for sensitive information. The attackers also abuse Amazon Cognito user pools via anonymous sign-ups and token collection. Hundreds of exposed ARTEX consoles were found, mainly in Mandarin and hosted in Singapore and Hong Kong. The framework is linked to the China-aligned threat actor Storm-0940 and features advanced post-exploitation capabilities such as automated resource discovery and credential harvesting across cloud environments.