I got hired in November 1996 and found out fast that cops don't make shit. My first year paid $10.63 an hour. So every cop I knew worked part-time jobs, plural. Some stretches I had four of them on top of the full-time job and its overtime.
The first one was a car dealership, on graves, and by police standards it was a good gig. No shoplifters, no guard post, no night desk. You sat in your own patrol car. The salty older guys who got me into the job also got me into this one, and they showed me the spot: a dark alley across the street, between two other lots and a storage shed. From there you could see the whole lot, both sides of the building, and the one way in and out.
The job was simple to say. Millions of dollars in inventory, and you made sure the staff had locked every car and nobody had left a key inside after a test drive. So the first hour of every shift, I walked the lot. Every car, every door handle, my light through every window at the cup holders, the ignition, the visor. Rain, frost on the glass, snow. Forty-five minutes to an hour, and it sucked.
Then seven hours of boredom. Talk radio. Magazines. Guys brought full tube TVs and game consoles and set them on the front seat. Chewing and spitting in a water bottle all night until your lip was raw. I played PSP in the front seat more than once.
More than one shift, that first hour found keys. Under a seat, in the glove box, tucked in a visor. Never an inside job, just somebody's oversight at closing on a bad-weather night. The car was still there in the morning.
That's what the salty guys taught me. Do it right, do it once, do it up front. The thief walks the same lot looking for the same open door, and this fall a tool showed up that makes that walk for them, across hundreds of organizations at once.
It's called ARTEX. ThreatBook's own CEO says it started as a personal project of one of the company's threat-detection engineers. It was open source on GitHub. Then the reports started.
Microsoft says a China-state-aligned group it tracks as Storm-0940 has used ARTEX since at least September, and assesses that group was behind the compromise of ConnectWise's Cloud Backup service. Microsoft saw ARTEX attempt sign-ins to more than 2,250 Microsoft 365 tenants. It also says most of the targeting wasn't successful. Zscaler and CrowdStrike separately tied ARTEX to intrusions at South Korean financial firms, and Zscaler counts stolen data on about 67,000 people.
On October 8 the author posted that the tool had been abused, disowned the attacks, and took it closed source. About a week later ThreatBook launched a paid platform that includes "Artex Pro."
The same day it went closed, a copycat version showed up on GitHub whose install pulled a prebuilt image, registered that day and pulled more than 8,700 times since. Security researchers posting about it report that the image, not the source code, carries a backdoor. I haven't seen a formal writeup yet.
So I went looking for it in our world.
In the public reporting I read through November 3, I found no report of ARTEX pointed at cameras, recorders, VMS or access control. The reports that describe how it got in point to stolen or sprayed credentials, cloud-app identities and web applications. Some entry details still aren't public. The ConnectWise product that was hit is a Microsoft 365 backup service, and ConnectWise says it has no indication its other products were touched.
If someone tells you ARTEX is hacking cameras, ask them for the report.
That's not the end of it, though.
What investigators measured is speed and scale. Microsoft saw multiple cases of less than three hours from first targeting to privileged access. Google's threat team saw one actor typically take about four hours from a first compromised account to deep access, and once, fifteen minutes. CrowdStrike tracked one group turning ARTEX on more than 200 organizations worldwide, with a single controller reaching targets in at least 14 countries over 11 days, and the human stepping in only to steer at decision points. None of that measures how much cheaper AI made an attack. Nobody has published that number, and I'm not going to make one up.
The case closest to our world isn't ARTEX at all. Earlier this year AWS documented a low-skill, financially motivated actor who used commercial AI tools to break into more than 600 FortiGate firewalls in more than 55 countries in about five weeks. No vulnerability was exploited. The way in was management interfaces exposed to the internet and weak, single-factor passwords. And when the actor hit hardened targets, it moved on.
Separately, Cisco Talos documented an AI coding assistant doing the hands-on work against live-camera streaming services, thousands of actions, recordings pulled. Different operator, different tool. Not ARTEX.
Our gear has its own open doors. In September CISA published an advisory on a Digital Watchdog DVR/NVR line with hard-coded credentials, rated 9.6. There's a firmware fix, CISA says it isn't remotely exploitable, and there's no known exploitation. A second advisory covers a CareCam camera that serves live video without a login, and the vendor didn't respond to CISA. Neither advisory involves AI.
Here's my inference, labeled as one. Recorders, VMS servers and remote-access tools have management pages too. The FortiGate case shows what a cheap operator with AI does with exposed admin pages and weak passwords. Applying that lesson to our equipment is my read on shared conditions. It isn't evidence that ARTEX is coming for cameras.
So walk your own lot first. The recommendations below come from the investigators. The physical-security translation is mine.
Find and close exposed management access. Know which recorder, VMS, camera and remote-access admin pages answer from the internet. Take them off it. Reach them through a restricted path with multi-factor login, and no shared or reused passwords. That's the AWS lesson, and Google, Zscaler and CISA all say a version of it.
Settle the devices CISA named. Apply the Digital Watchdog firmware fix where it applies. The CareCam advisory lists no fix, so isolating or replacing that camera is my recommendation, not CISA's.
Account for your vendors' standing access. If you run Microsoft 365 integrations, Microsoft's advice is to inventory apps by application ID, not display name, with their permissions and owners, and to verify that a vendor's credential rotation actually removed the old access. I'd apply the same rule to any integration that has standing access to your sites.
One more, for anyone testing these tools themselves: install from the publisher. A reviewed source tree doesn't vouch for a prebuilt image somebody else built.
Pull the logs before they roll off. Microsoft Entra sign-in logs keep 7 days on the free tier and 30 on the paid ones. ConnectWise put it plainly: "a clean search does not rule out activity missing from the logs." The seven hours of watching only count if you can play them back.
One line in the AWS report is worth reading twice. The actor moved on from hardened targets. That's one actor, one campaign, and it has limits. It's still the most useful thing in this whole story, because it means the check works.
I pulled every handle so the thief didn't find the open one first. The new tool doesn't get tired, and it doesn't skip the cars covered in frost.
Which of your doors are still open?
My day job is selling AI to police, and before that I worked for Axis. Nothing in this piece involves either company or its products.
Lab: Primary sources read November 3, 2026. Claude Code pulled and checked the sources and drafted from my outline and my own story; OpenAI Codex (GPT-6 Astra) challenged the outline, and the thesis was narrowed on its notes. Built and checked with Claude Code.