ConnectWise
CompanyRecent news
Attackers use open-source ARTEX AI agent to automate Active Directory attacks
ARTEX, an open-source multi-agent penetration testing and command-and-control platform written in Go, is being abused to automate Active Directory attacks, including Kerberoasting, DCSync and lateral movement. Google's Threat Intelligence Group and Mandiant have seen it used since late August 2026 against organisations in several sectors, and Microsoft has linked it to a China-linked group targeting Microsoft 365 tenants. Google says it trades stealth for speed, so defenders can still detect it through its noisy logs and artefacts.
China-backed group used agentic AI tool ARTEX to compromise about 140 targets in 11 days
CrowdStrike tracks the China state-backed group Vapor Panda, which is using ARTEX, an automated agentic AI penetration testing framework, paired with DeepSeek. The campaign has targeted more than 200 organisations in at least 14 countries since 17 October, with about 70% of targets confirmed or likely compromised, and it remains active. CrowdStrike says organisations need visibility into endpoints, identities and cross-domain capabilities to respond.