Attackers use open-source ARTEX AI agent to automate Active Directory attacks
AI SECURITYActive Directoryredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
ARTEX, an open-source multi-agent penetration testing and command-and-control platform written in Go, is being abused to automate Active Directory attacks, including Kerberoasting, DCSync and lateral movement. Google's Threat Intelligence Group and Mandiant have seen it used since late August 2026 against organisations in several sectors, and Microsoft has linked it to a China-linked group targeting Microsoft 365 tenants. Google says it trades stealth for speed, so defenders can still detect it through its noisy logs and artefacts.
For IT people · Written by AI from 1 source · Wrong?
What to do
- Isolate administrative systems and use short-lived credentials with limited access.
- Segment networks to restrict lateral movement toward domain controllers.
- Hunt for ArtexProbe account names, artex-probe- files and the listed JSP web shell names.
- Alert on MySQL generallog changes that write .jsp files and on curl traffic to webhook.site.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Cyber Security News
Who and what is in it
Malware
Products