[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fZxhkL3pDyvWApgugipzqOp9z6hkmDkeskPCnWx2p-zM":3},{"article":4,"iocs":56,"watch_terms":64,"solutions":65,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"176b4714-180c-4ec0-96c6-6ba9ff6eb8bf","The Rise of Agentic Attacks: What They Look Like, and Where They're Headed","the-rise-of-agentic-attacks-what-they-look-like-and-where-they-re-headed-1145d7","AI agents are changing how attackers operate. Explore real-world cases of agentic attacks, learn how to identify their fingerprints, and discover what they mean for the future of cybersecurity.","AI agents are becoming a significant tool for threat actors, automating complex attack phases like reconnaissance, lateral movement, and data exfiltration at machine speed. Frameworks like ARTEX and Hermes are being employed in real-world attacks, including supply chain compromises and targeting financial institutions. While these agentic attacks can be noisy, defenders face the challenge of distinguishing malicious automation from legitimate activity.","AI agents are increasingly used in cyberattacks, automating reconnaissance and exploitation.","https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fthe-rise-of-agentic-attacks","https:\u002F\u002Fwww.datocms-assets.com\u002F75231\u002F1793283240-image-14.png","2026-10-29T14:26:22+00:00","2026-10-29T15:00:13.653431+00:00",8,[17,20,23,25,28,31],{"name":18,"type":19},"AI agents","technology",{"name":21,"type":22},"ARTEX","product",{"name":24,"type":22},"Hermes",{"name":26,"type":27},"Storm-0940","threat_actor",{"name":29,"type":30},"Microsoft","vendor",{"name":32,"type":30},"Zscaler","e7b231c8-5f79-4465-8d38-1ef13aea5a14",{"id":33,"icon":35,"name":36,"slug":37},null,"Threat Intelligence","threat-intelligence",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":55},{"id":33,"icon":35,"name":36,"slug":37},[57,60,62],{"type":58,"value":21,"context":59},"malware","Agentic penetration-testing framework used in attacks",{"type":58,"value":24,"context":61},"AI agent used in unattended mode for enumeration and privilege escalation",{"type":58,"value":26,"context":63},"China-state-aligned threat actor using ARTEX",[29,32,21],{"controls":66,"vendors":147},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":126,"name":127,"problem":128,"products":129},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[130,138,146],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},[148,151,155,160],{"slug":73,"name":74,"logo_path":75,"roles":149},[150],"reported_by",{"slug":152,"name":29,"logo_path":153,"roles":154},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[150],{"slug":156,"name":157,"logo_path":158,"roles":159},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[150],{"slug":161,"name":32,"logo_path":162,"roles":163},"zscaler","\u002Fvendor-logos\u002Fzscaler.png",[150],{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":176},"ai-powered-agentic-attacks-are-automating-the-entire-kill-chain","AI-Powered Agentic Attacks Are Automating the Entire Kill Chain","Threat actors are leveraging AI agent frameworks like ARTEX and Hermes to automate complex, multi-stage attacks — including reconnaissance, lateral movement, and data exfiltration — at speeds no human operator could match. This means defenders have far less time to detect and respond before significant damage is done. The challenge is compounded by the fact that agentic attack traffic can closely resemble legitimate automation, making traditional detection heuristics less reliable. The supply chain vector adds another layer of risk, as trusted software pipelines become entry points for AI-driven compromise. Organizations that lack behavioral baselining and mature monitoring capabilities are especially exposed.",[169,170,171,172,173,174,175],"CIS Control 13: Network Monitoring and Defense","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","MITRE ATT&CK T1566: Phishing","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":177,"MITRE ATT&CK T1566: Phishing":178,"NIST SP 800-53 SI-2: Flaw Remediation":179,"CIS Control 17: Incident Response Management":180,"CIS Control 13: Network Monitoring and Defense":181,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":182,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":183},"NIS2 requires incident handling and monitoring capabilities proportionate to evolving threats; the rise of agentic attacks demands that essential and important entities upgrade detection capabilities to handle machine-speed intrusions.","Agentic frameworks can automate spear-phishing at scale as an initial access technique, making it critical to map defenses against this well-documented tactic as part of threat modeling agentic attacks.","Supply chain compromises involving AI agents often exploit known vulnerabilities in third-party components; timely flaw remediation and vendor patch tracking would reduce the attack surface available to automated exploitation.","Traditional IR playbooks are not designed for the velocity of AI-driven attacks; a purpose-built, regularly tested IR plan for automated attack scenarios is required to respond effectively.","Agentic attacks move at machine speed across the network; continuous monitoring of network traffic for anomalous automated behavior is essential to detect lateral movement and exfiltration before damage is complete.","Structured vulnerability management across the supply chain is critical to preventing AI-driven attackers from exploiting unpatched weaknesses in trusted third-party software used in financial and enterprise environments.","AI agents that gain a foothold can escalate and move laterally rapidly; enforcing least-privilege and strong authentication limits the scope of actions an agent can take autonomously."]