[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"post:artex-ai-autonomous-agents-run-active-directory-attacks-at":3},{"post":4,"author":20,"controls":27,"vendors":28,"more":29},{"slug":5,"kind":6,"title":7,"excerpt":8,"cover_image_url":9,"cover_image_alt":10,"author_name":11,"published_at":12,"body_md":13,"author_title":14,"regulation_refs":15,"ai_assisted":16,"cover_ai_generated":17,"updated_at":18,"reading_minutes":19},"artex-ai-autonomous-agents-run-active-directory-attacks-at","rapid-alert","ARTEX AI: autonomous agents run Active Directory attacks at machine speed against 200+ orgs","Chinese-linked actors are using the open-source ARTEX AI framework to automate Kerberoasting, DCSync and lateral movement. Google, Mandiant and CrowdStrike report attacks on over 200 organisations, with one breach reaching root in 12 minutes.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fartex-ai-autonomous-agents-run-active-directory-attacks-at-02704500-cover.png","ARTEX AI rapid alert: Still trust slow attacks to catch? A machine takes your domain in minutes","Marcus Lenngren","2026-11-03T04:23:57.557+00:00","![ARTEX AI rapid alert: Still trust slow attacks to catch? A machine takes your domain in minutes](https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fartex-ai-autonomous-agents-run-active-directory-attacks-at-02704500-card.png \"The rapid alert card: save it and share it with your team\")\n\n## What happened\n\nAttackers are using ARTEX, an open-source multi-agent AI penetration-testing framework written in Go, to automate large parts of a network break-in. The operator gives it a goal and some stolen credentials, and the framework turns that into commands: it maps a Windows network, steals service account passwords through Kerberoasting, runs DCSync, and tries to spread to domain controllers.\n\nResearchers at Google Threat Intelligence Group, Mandiant, CrowdStrike and Wiz identified the activity during incident response. Google has seen ARTEX used since late August 2026. CrowdStrike tracks one campaign as Vapor Panda that began on 17 October 2026 and targeted more than 200 organisations across 14 countries. Microsoft ties related activity to a China-linked group, STORM-0940, which Google calls UNC7228.\n\nThe tool splits the attack into six sub-agents. In several cases the intruders handed ARTEX valid logins and told it to run the later stages. In one case it pulled more than 110,000 Active Directory objects and read the Domain Admins group. It then took the krbtgt key, cloud sync credentials and domain controller hashes.\n\n## Timeline\n\n- Late August 2026: first ARTEX activity seen by Mandiant.\n- September 2026: DIVD breached, initial access to root in 12 minutes using two zero-days.\n- October 2026: the original author takes the code off GitHub; forks ScopeWeaver and ARTEX PRO spread.\n- 17 October 2026: Vapor Panda campaign begins against 200+ organisations.\n- 2 November 2026: Google, Mandiant and CrowdStrike publish details.\n\n## Am I affected?\n\nTargets span government ministries, telecommunications, pharmaceutical, semiconductor, defence, nuclear, financial, chemicals and manufacturing sectors. Confirmed victims include telecoms providers in the US and Belgium, government bodies in Greece, the Middle East and Latin America, and US pharmaceutical firms.\n\nThe attack uses valid accounts and normal admin tools, so static indicators will miss much of it. The signature is speed. Google saw single bursts of activity running for about 2 to 25 seconds, and one case with 27 events in 23 seconds. The tool is noisy: DIVD recorded over 450,000 requests and 2,500 scripts, and in one case ARTEX created 240 log events while trying to plant web shells through MySQL log poisoning.\n\n## What to do now\n\n1. Isolate admin systems and tiering. Keep domain controllers and federation servers away from general access.\n2. Move to short-lived credentials and rotate service account passwords, especially accounts with service principal names that are targets for Kerberoasting.\n3. Rotate the krbtgt key twice if you suspect DCSync, since stolen keys allow forged tickets.\n4. Review ADCS certificate templates for abuse, as ARTEX scripts enumerated them.\n5. Segment networks and limit lateral movement paths used by Pass-the-Ticket, WinRM, Kerberos relay and Pass-the-Hash.\n6. Watch for bursts of admin activity completing in seconds, which no human could produce.\n\n## How to hunt\n\n- Look for outbound connections to webhook.site, used to exfiltrate command output via curl across rotating URLs.\n- Search for probe files matching artex-probe-* with five-digit incremental numbers.\n- Hunt for JSP web shells named cl1217.jsp, f1219a.jsp and z1219.jsp written through MySQL log poisoning.\n- Check for the MySQL commands SET GLOBAL general_log_file and SET GLOBAL general_log = 1.\n- Look for created accounts named ArtexProbe with plaintext passwords and is_admin=true set within minutes.\n- Watch for persistent AWS t3.micro jump host instances.\n- Google SecOps rules to enable: Suspicious Webhook.Site Interaction, Suspicious Curl Invocation, Cmd Launching Curl, AWS Cloud Accounts Getcalleridentity.\n\n## What does not help\n\nStatic indicators alone will miss most of this activity, because attackers use valid accounts and normal admin tools. In one campaign the operators explicitly told the agents to skip Windows machines protected by endpoint protection and focus on unprotected hosts, so uneven coverage leaves gaps. Hunt for behaviour and speed, not just file hashes.\n\n## Sources\n\n- [Hackers Use ARTEX AI Agents to Automate Active Directory Attacks, Kerberoasting, and Lateral Movement](https:\u002F\u002Fcybersecuritynews.com\u002Fhackers-use-artex-ai-agents\u002F), Cyber Security News, 2 Nov\n- [Chinese hackers use ARTEX AI in automated attacks against 200 orgs](https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fchinese-hackers-use-artex-ai-in-automated-attacks-against-200-orgs\u002F), BleepingComputer, 2 Nov\n",null,[],true,false,"2026-11-03T04:44:21.861+00:00",3,{"name":11,"slug":21,"same_as":22,"job_title":23,"photo_url":24,"short_bio":25,"linkedin_url":26},"marcus-lenngren",[],"Founder, ThreatNoir","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Fauthors\u002Fmarcus-lenngren-ca3a2dad9da5.jpg","Founder of ThreatNoir. Security and technology leader: CTO and CISO in a regulated industry, head of applications, network and data centre at Schibsted Sverige, and today security engineering for a global retailer's SOC. CISSP, CISM and AAISM.","https:\u002F\u002Fwww.linkedin.com\u002Fin\u002Fmarcuslenngren",[],[],[30,37,44],{"slug":31,"kind":6,"title":32,"excerpt":33,"cover_image_url":34,"cover_image_alt":35,"author_name":11,"published_at":36,"reading_minutes":19},"check-point-gaia-under-attack-php2shell-chained-to-root-for","Check Point Gaia under attack: PHP2Shell chained to root for ESXi wiper, patch now","Attackers are chaining PHP2Shell (CVE-2026-109618\u002F9) with a DynamicCLI root flaw (CVE-2026-123039) on Check Point Mobile Access gateways, then wiping VMware ESXi hosts. Patch and hunt tonight.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcheck-point-gaia-under-attack-php2shell-chained-to-root-for-05b9bf1d-cover.png","Check Point Gaia rapid alert: Mobile Access portal exposed? One chain and your ESXi is wiped.","2026-11-13T11:18:49.874+00:00",{"slug":38,"kind":6,"title":39,"excerpt":40,"cover_image_url":41,"cover_image_alt":42,"author_name":11,"published_at":43,"reading_minutes":19},"4everable2shell-n-central-hotfix-2-servers-taken-to-root","4EverAble2Shell: N-central Hotfix 2 Servers Taken to Root Hours After PoC Dropped","A new N-able N-central exploit chain, 4EverAble2Shell, gives unauthenticated root on servers running the latest Hotfix 2. Attackers began mining within hours of the PoC, hitting 21 servers, 19 of them patched. Disable Legacy API and take on-prem N-central offline now.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002F4everable2shell-n-central-hotfix-2-servers-taken-to-root-68758f4e-cover.png","N-central HF2 rapid alert: Patched N-central to Hotfix 2? Root on the box running your clients.","2026-11-13T08:52:08.367+00:00",{"slug":45,"kind":6,"title":46,"excerpt":47,"cover_image_url":48,"cover_image_alt":49,"author_name":11,"published_at":50,"reading_minutes":19},"citrus-ransomware-abuses-group-policy-to-push-sn00py-and","Citrus ransomware abuses Group Policy to push Sn00py and disable Microsoft Defender across domains","Citrus, a newly documented crew tracked by Securelist, uses stolen contractor logins to reach a domain controller, then builds a malicious GPO named Kaspersky GPO that drops Sn00py ransomware and turns off Defender on every joined machine.","https:\u002F\u002Fzbqafrnxsxwbarztrtqp.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fresources\u002Frapid\u002Fcitrus-ransomware-abuses-group-policy-to-push-sn00py-and-fb0efdd6-cover.png","Citrus Ransomware rapid alert: Your DC pushes GPOs to everyone? One policy kills Defender domain-wide.","2026-11-12T08:02:16.435+00:00"]