Attackers use open-source ARTEX AI agent to automate Active Directory attacks
- Severity
- High
- Sources
- 1
What happened
ARTEX, a Go-based multi-agent C2 framework whose original GitHub repository was removed in October 2026, is being abused via forks including ScopeWeaver and a paid ARTEX PRO. Google GTIG and Mandiant have observed use since late August 2026, including Kerberoasting, DCSync for the krbtgt key and domain controller hashes, Pass-the-Ticket, WinRM, Kerberos relay and Pass-the-Hash attempts. Wiz tracks the activity as UNC7228, overlapping Microsoft's STORM-0940. Defenders should isolate admin systems, use short-lived credentials, limit access, segment networks and hunt for ArtexProbe account names, artex-probe- files, JSP web shells written via MySQL generallog changes, and webhook.site traffic. Static IOCs will miss much of this as valid accounts and admin tools are used.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Isolate administrative systems and use short-lived credentials with limited access.
- Segment networks to restrict lateral movement toward domain controllers.
- Hunt for ArtexProbe account names, artex-probe- files and the listed JSP web shell names.
- Alert on MySQL generallog changes that write .jsp files and on curl traffic to webhook.site.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Who and what is in it
Malware
Products