Mandiant
CompanyFacts
- Country
- United StatesSource: Wikidata
- Founded
- 2004Source: Wikidata
- Sector
- Computer securitySource: Wikidata
- Official website
- www.mandiant.comSource: Wikidata
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Vulnerability reported by CISA AlertsFresh probes target critical BeyondTrust Remote Support flaw CVE-2026-102764
- Vulnerability reported by Horizon3.aiAttackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
Recent news
Hackers weaponise ARTEX AI agents to automate network intrusions and data theft
Threat actors are abusing ARTEX, an autonomous penetration-testing framework, to speed up network intrusions, escalate privileges and exfiltrate sensitive data. Google Threat Intelligence Group and Mandiant investigations describe attackers delegating much of their post-compromise activity to coordinated AI agents, compressing execution into seconds. The activity has been observed since late August 2026.
Attackers use open-source ARTEX AI agent to automate Active Directory attacks
ARTEX, an open-source multi-agent penetration testing and command-and-control platform written in Go, is being abused to automate Active Directory attacks, including Kerberoasting, DCSync and lateral movement. Google's Threat Intelligence Group and Mandiant have seen it used since late August 2026 against organisations in several sectors, and Microsoft has linked it to a China-linked group targeting Microsoft 365 tenants. Google says it trades stealth for speed, so defenders can still detect it through its noisy logs and artefacts.
Fresh probes target critical BeyondTrust Remote Support flaw CVE-2026-102764
Previdian reported two probes against decoy BeyondTrust Remote Support appliances in the US and Europe, both from one Hong Kong IP address, targeting POST /api/startsession. The traffic resembled a Metasploit module under review, though not an exact match, and no successful exploitation was observed. The flaw is CVE-2026-102764 (CVSS 9.3), which affects Remote Support 26.2.3 and earlier, and CISA has added it to the Known Exploited Vulnerabilities catalogue.
Attackers probe critical Oracle E-Business Suite flaw CVE-2026-101767 after October patch
CVE-2026-101767 is an unauthenticated SQL injection in Oracle E-Business Suite's Thin Client Framework servlet that chains to remote code execution, with a CVSS score of 9.8. Oracle patched it in its October 2026 Critical Patch Update, and Defused Cyber decoys recorded exploratory exploitation on 27 October. The Canadian Centre for Cyber Security has updated its advisory to say open source reporting indicates exploitation in the wild.