[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f6zryEh5DpaoiEQAk0ctcZrfG_rBfiCytFTsQDe2Rg90":3},{"article":4,"iocs":54,"watch_terms":80,"solutions":81,"lesson":179},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"017ae2f7-f0e6-4a51-bb36-4697d68bfa24","Hackers Use ARTEX AI Agents to Automate Active Directory Attacks, Kerberoasting, and Lateral Movement","hackers-use-artex-ai-agents-to-automate-active-directory-attacks-kerberoasting-a-c47cd4","Hackers are now using an open-source AI tool called ARTEX to run large parts of a network break-in on their own. The tool can map a Windows network, steal service account passwords, and try to spread to domain controllers with very little human help. It does this in seconds, not hours. ARTEX is a multi-agent […] The post Hackers Use ARTEX AI Agents to Automate Active Directory Attacks, Kerberoasting, and Lateral Movement appeared first on Cyber Security News.","Hackers are leveraging the open-source AI tool ARTEX to automate complex network intrusions, including mapping Windows networks, stealing service account passwords, and performing lateral movement to domain controllers. Originally designed for penetration testing, ARTEX has been adopted by malicious actors, including suspected state-linked groups, to execute attacks in seconds rather than hours. While the tool's speed is a significant advantage for attackers, its noisy execution can also provide defenders with opportunities to detect and respond.","Hackers use open-source AI tool ARTEX to automate Active Directory attacks, kerberoasting, and lateral movement.","https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-artex-ai-agents\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-ARTEX-AI-Agents-to-Automate-Active-Directory-Attacks-Kerberoasting-and-Lateral-Movement.webp","2026-11-02T08:23:36+00:00","2026-11-02T09:00:26.388835+00:00",9,[17,20,22,24,27,29],{"name":18,"type":19},"ARTEX","product",{"name":21,"type":19},"ScopeWeaver",{"name":23,"type":19},"ARTEX PRO",{"name":25,"type":26},"Google Cloud","vendor",{"name":28,"type":26},"Mandiant",{"name":30,"type":26},"Microsoft","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":31,"icon":33,"name":34,"slug":35},null,"Threat Intelligence","threat-intelligence",[37,42,47,52],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":48},{"id":49,"icon":33,"name":50,"slug":51},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":53},{"id":31,"icon":33,"name":34,"slug":35},[55,57,59,61,65,68,71,74,77],{"type":51,"value":18,"context":56},"AI-powered penetration testing and command-and-control platform used for automating network attacks.",{"type":51,"value":21,"context":58},"Community fork of the ARTEX tool.",{"type":51,"value":23,"context":60},"Paid version of the ARTEX tool.",{"type":62,"value":63,"context":64},"mitre_attack","T1558.003","Kerberoasting technique leveraged by ARTEX.",{"type":62,"value":66,"context":67},"T1003.006","DCSync scripts used by ARTEX to steal krbtgt key and domain controller hashes.",{"type":62,"value":69,"context":70},"T1558.004","Pass-the-Ticket technique used by ARTEX for lateral movement.",{"type":62,"value":72,"context":73},"T1021.006","Windows Remote Management (WinRM) used by ARTEX for lateral movement.",{"type":62,"value":75,"context":76},"T1078.002","Valid accounts used to initiate ARTEX attacks.",{"type":62,"value":78,"context":79},"T1047","Windows Management Instrumentation (WMI) used by ARTEX.",[30,25,28],{"controls":82,"vendors":167},[83,112,138],{"slug":84,"name":85,"problem":86,"products":87},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":134,"product_name":135,"url":136,"description":137},"managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":139,"name":140,"problem":141,"products":142},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[143,151,159],{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":147,"product_name":148,"url":149,"description":150},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":152,"vendor_name":153,"vendor_logo":154,"product_slug":155,"product_name":156,"url":157,"description":158},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":160,"vendor_name":161,"vendor_logo":162,"product_slug":163,"product_name":164,"url":165,"description":166},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[168,174],{"slug":169,"name":170,"logo_path":171,"roles":172},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[173],"reported_by",{"slug":175,"name":30,"logo_path":176,"roles":177},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[178],"affected",{"slug":180,"title":181,"body":182,"framework_refs":183,"framework_notes":191},"ai-powered-artex-tool-automates-active-directory-attacks-at-machine-speed","AI-Powered ARTEX Tool Automates Active Directory Attacks at Machine Speed","Threat actors, including suspected state-linked groups, are weaponizing the open-source penetration testing tool ARTEX to automate Kerberoasting, Active Directory mapping, and lateral movement — collapsing attack timelines from hours to seconds. The root issue lies in weak access controls around privileged service accounts and insufficient monitoring of authentication anomalies within Windows environments. Kerberoasting succeeds specifically because service accounts are often over-privileged and use weak or legacy encryption, making their credentials trivially crackable offline. The speed of AI-driven automation means defenders have an extremely narrow window to detect and interrupt the attack chain. This incident underscores that hardening identity infrastructure and investing in robust detection capabilities are no longer optional — they are existential priorities.",[184,185,186,187,188,189,190],"MITRE ATT&CK T1558.003: Kerberoasting","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 5: Account Management","CIS Control 8: Audit Log Management","NIST SP 800-53 AC-6: Least Privilege","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":192,"CIS Control 5: Account Management":193,"CIS Control 8: Audit Log Management":194,"NIST SP 800-53 AC-6: Least Privilege":195,"MITRE ATT&CK T1558.003: Kerberoasting":196,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":197,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":198},"NIS2 requires incident handling and access-control measures for essential entities; the automated, rapid nature of ARTEX attacks demands the real-time monitoring and privileged access controls this article mandates.","Enforcing least privilege and eliminating unnecessary or over-privileged service accounts would deny ARTEX the high-value targets it needs to escalate to domain controller access.","Collecting and analysing Kerberos-related Windows Event logs would surface the anomalous TGS request volumes that ARTEX's noisy execution generates, enabling timely detection.","Restricting service accounts to only the permissions required for their function limits the blast radius when credentials are stolen and prevents lateral movement to domain controllers.","ARTEX directly automates Kerberoasting to harvest and crack service account credentials offline; understanding and defending against this specific technique is central to preventing this attack.","Regularly reviewing Active Directory configurations, SPN registrations, and Kerberos encryption settings as technical vulnerabilities would identify and remediate the weak postures that ARTEX exploits.","Hardening service account privileges, enforcing strong Kerberos encryption, and adopting managed service accounts directly address the identity weaknesses that make Kerberoasting and lateral movement possible."]