What happened
Attackers are using ARTEX, an open-source multi-agent AI penetration-testing framework written in Go, to automate large parts of a network break-in. The operator gives it a goal and some stolen credentials, and the framework turns that into commands: it maps a Windows network, steals service account passwords through Kerberoasting, runs DCSync, and tries to spread to domain controllers.
Researchers at Google Threat Intelligence Group, Mandiant, CrowdStrike and Wiz identified the activity during incident response. Google has seen ARTEX used since late August 2026. CrowdStrike tracks one campaign as Vapor Panda that began on 17 October 2026 and targeted more than 200 organisations across 14 countries. Microsoft ties related activity to a China-linked group, STORM-0940, which Google calls UNC7228.
The tool splits the attack into six sub-agents. In several cases the intruders handed ARTEX valid logins and told it to run the later stages. In one case it pulled more than 110,000 Active Directory objects and read the Domain Admins group. It then took the krbtgt key, cloud sync credentials and domain controller hashes.
Timeline
- Late August 2026: first ARTEX activity seen by Mandiant.
- September 2026: DIVD breached, initial access to root in 12 minutes using two zero-days.
- October 2026: the original author takes the code off GitHub; forks ScopeWeaver and ARTEX PRO spread.
- 17 October 2026: Vapor Panda campaign begins against 200+ organisations.
- 2 November 2026: Google, Mandiant and CrowdStrike publish details.
Am I affected?
Targets span government ministries, telecommunications, pharmaceutical, semiconductor, defence, nuclear, financial, chemicals and manufacturing sectors. Confirmed victims include telecoms providers in the US and Belgium, government bodies in Greece, the Middle East and Latin America, and US pharmaceutical firms.
The attack uses valid accounts and normal admin tools, so static indicators will miss much of it. The signature is speed. Google saw single bursts of activity running for about 2 to 25 seconds, and one case with 27 events in 23 seconds. The tool is noisy: DIVD recorded over 450,000 requests and 2,500 scripts, and in one case ARTEX created 240 log events while trying to plant web shells through MySQL log poisoning.
What to do now
- Isolate admin systems and tiering. Keep domain controllers and federation servers away from general access.
- Move to short-lived credentials and rotate service account passwords, especially accounts with service principal names that are targets for Kerberoasting.
- Rotate the krbtgt key twice if you suspect DCSync, since stolen keys allow forged tickets.
- Review ADCS certificate templates for abuse, as ARTEX scripts enumerated them.
- Segment networks and limit lateral movement paths used by Pass-the-Ticket, WinRM, Kerberos relay and Pass-the-Hash.
- Watch for bursts of admin activity completing in seconds, which no human could produce.
How to hunt
- Look for outbound connections to webhook.site, used to exfiltrate command output via curl across rotating URLs.
- Search for probe files matching artex-probe-* with five-digit incremental numbers.
- Hunt for JSP web shells named cl1217.jsp, f1219a.jsp and z1219.jsp written through MySQL log poisoning.
- Check for the MySQL commands SET GLOBAL general_log_file and SET GLOBAL general_log = 1.
- Look for created accounts named ArtexProbe with plaintext passwords and is_admin=true set within minutes.
- Watch for persistent AWS t3.micro jump host instances.
- Google SecOps rules to enable: Suspicious Webhook.Site Interaction, Suspicious Curl Invocation, Cmd Launching Curl, AWS Cloud Accounts Getcalleridentity.
What does not help
Static indicators alone will miss most of this activity, because attackers use valid accounts and normal admin tools. In one campaign the operators explicitly told the agents to skip Windows machines protected by endpoint protection and focus on unprotected hosts, so uneven coverage leaves gaps. Hunt for behaviour and speed, not just file hashes.
Sources
- Hackers Use ARTEX AI Agents to Automate Active Directory Attacks, Kerberoasting, and Lateral Movement, Cyber Security News, 2 Nov
- Chinese hackers use ARTEX AI in automated attacks against 200 orgs, BleepingComputer, 2 Nov
