[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:artex-ai-autonomous-agents-run-active-directory-attacks-at":3},{"post":4,"author":20,"controls":27,"vendors":28,"more":29},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":18,"reading_minutes":19},"artex-ai-autonomous-agents-run-active-directory-attacks-at","rapid-alert","ARTEX AI: autonomous agents run Active Directory attacks at machine speed against 200+ orgs","Chinese-linked actors are using the open-source ARTEX AI framework to automate Kerberoasting, DCSync and lateral movement. Google, Mandiant and CrowdStrike report attacks on over 200 organisations, with one breach reaching root in 12 minutes.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fartex-ai-autonomous-agents-run-active-directory-attacks-at-02704500-cover.png","ARTEX AI rapid alert: Still trust slow attacks to catch? A machine takes your domain in minutes","Marcus Lenngren","2026-11-03T04:23:57.557+00:00","![ARTEX AI rapid alert: Still trust slow attacks to catch? A machine takes your domain in minutes](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fartex-ai-autonomous-agents-run-active-directory-attacks-at-02704500-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nAttackers are using ARTEX, an open-source multi-agent AI penetration-testing framework written in Go, to automate large parts of a network break-in. The operator gives it a goal and some stolen credentials, and the framework turns that into commands: it maps a Windows network, steals service account passwords through Kerberoasting, runs DCSync, and tries to spread to domain controllers.\n\nResearchers at Google Threat Intelligence Group, Mandiant, CrowdStrike and Wiz identified the activity during incident response. Google has seen ARTEX used since late August 2026. CrowdStrike tracks one campaign as Vapor Panda that began on 17 October 2026 and targeted more than 200 organisations across 14 countries. Microsoft ties related activity to a China-linked group, STORM-0940, which Google calls UNC7228.\n\nThe tool splits the attack into six sub-agents. In several cases the intruders handed ARTEX valid logins and told it to run the later stages. In one case it pulled more than 110,000 Active Directory objects and read the Domain Admins group. It then took the krbtgt key, cloud sync credentials and domain controller hashes.\n\n## Timeline\n\n- Late August 2026: first ARTEX activity seen by Mandiant.\n- September 2026: DIVD breached, initial access to root in 12 minutes using two zero-days.\n- October 2026: the original author takes the code off GitHub; forks ScopeWeaver and ARTEX PRO spread.\n- 17 October 2026: Vapor Panda campaign begins against 200+ organisations.\n- 2 November 2026: Google, Mandiant and CrowdStrike publish details.\n\n## Am I affected?\n\nTargets span government ministries, telecommunications, pharmaceutical, semiconductor, defence, nuclear, financial, chemicals and manufacturing sectors. Confirmed victims include telecoms providers in the US and Belgium, government bodies in Greece, the Middle East and Latin America, and US pharmaceutical firms.\n\nThe attack uses valid accounts and normal admin tools, so static indicators will miss much of it. The signature is speed. Google saw single bursts of activity running for about 2 to 25 seconds, and one case with 27 events in 23 seconds. The tool is noisy: DIVD recorded over 450,000 requests and 2,500 scripts, and in one case ARTEX created 240 log events while trying to plant web shells through MySQL log poisoning.\n\n## What to do now\n\n1. Isolate admin systems and tiering. Keep domain controllers and federation servers away from general access.\n2. Move to short-lived credentials and rotate service account passwords, especially accounts with service principal names that are targets for Kerberoasting.\n3. Rotate the krbtgt key twice if you suspect DCSync, since stolen keys allow forged tickets.\n4. Review ADCS certificate templates for abuse, as ARTEX scripts enumerated them.\n5. Segment networks and limit lateral movement paths used by Pass-the-Ticket, WinRM, Kerberos relay and Pass-the-Hash.\n6. Watch for bursts of admin activity completing in seconds, which no human could produce.\n\n## How to hunt\n\n- Look for outbound connections to webhook.site, used to exfiltrate command output via curl across rotating URLs.\n- Search for probe files matching artex-probe-* with five-digit incremental numbers.\n- Hunt for JSP web shells named cl1217.jsp, f1219a.jsp and z1219.jsp written through MySQL log poisoning.\n- Check for the MySQL commands SET GLOBAL general_log_file and SET GLOBAL general_log = 1.\n- Look for created accounts named ArtexProbe with plaintext passwords and is_admin=true set within minutes.\n- Watch for persistent AWS t3.micro jump host instances.\n- Google SecOps rules to enable: Suspicious Webhook.Site Interaction, Suspicious Curl Invocation, Cmd Launching Curl, AWS Cloud Accounts Getcalleridentity.\n\n## What does not help\n\nStatic indicators alone will miss most of this activity, because attackers use valid accounts and normal admin tools. In one campaign the operators explicitly told the agents to skip Windows machines protected by endpoint protection and focus on unprotected hosts, so uneven coverage leaves gaps. Hunt for behaviour and speed, not just file hashes.\n\n## Sources\n\n- [Hackers Use ARTEX AI Agents to Automate Active Directory Attacks, Kerberoasting, and Lateral Movement](https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-artex-ai-agents\u002F), Cyber Security News, 2 Nov\n- [Chinese hackers use ARTEX AI in automated attacks against 200 orgs](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fchinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs\u002F), BleepingComputer, 2 Nov\n",null,[],true,false,"2026-11-03T04:44:21.861+00:00",3,{"name":11,"slug":21,"same_as":22,"job_title":23,"photo_url":24,"short_bio":25,"linkedin_url":26},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[30,37,44],{"slug":31,"kind":6,"title":32,"excerpt":33,"cover_image_url":34,"cover_image_alt":35,"author_name":11,"published_at":36,"reading_minutes":19},"xcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor","XCPE botnet: 1.3M Android TV boxes shipped with a backdoor, Google and police disrupt it","Google, Japan's NPA and partners disrupted XCPE, a backdoor that OEM Videostrong allegedly built into Android TV box firmware, enrolling more than 1.3 million devices. Removing the app does not help: it reinstalls from a protected partition on reboot.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fxcpe-botnet-1-3m-android-tv-boxes-shipped-with-a-backdoor-305686fc-cover.png","XCPE botnet rapid alert: Bought a cheap Android TV box? The backdoor shipped inside it.","2026-11-03T04:18:31.219+00:00",{"slug":38,"kind":6,"title":39,"excerpt":40,"cover_image_url":41,"cover_image_alt":42,"author_name":11,"published_at":43,"reading_minutes":19},"coruna-and-darksword-zero-click-iphone-spyware-steals-data","Coruna and DarkSword: zero-click iPhone spyware steals data from a single web page visit","Two iPhone exploit kits, Coruna and DarkSword, infect phones from a single web page with no app and no prompt. Zimperium found 608 delivery domains. Apple has notified targeted users in 99 countries. Every CVE is already patched.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcoruna-and-darksword-zero-click-iphone-spyware-steals-data-9c36ddb3-cover.png","Coruna\u002FDarkSword rapid alert: Your iPhone on iOS 17 or 18? One web page visit and it is theirs.","2026-11-01T05:36:03.059+00:00",{"slug":45,"kind":46,"title":47,"excerpt":48,"cover_image_url":49,"cover_image_alt":50,"author_name":11,"published_at":51,"reading_minutes":52},"package-security-without-starting-on-the-laptop","analysis","Package security in three steps, and why you do not have to start on the laptop","AI coding agents now pick and install packages on engineering machines in seconds, and few teams can say what was pulled in. A threat feed you can search this week, a registry firewall that fits the network you already run, and the endpoint last. Notes from a session with Socket.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fblog\u002Fai-1cc0747e-9558-4214-a9a4-10cae453ca38.png","A digital shield protects a data stream from threats, representing layered package security.","2026-10-31T07:07:36.208+00:00",4]