Cybercriminals are increasingly using the open-source AI tool ARTEX to automate significant portions of network intrusions. This tool is capable of mapping Windows networks, stealing service account credentials, and attempting to move laterally to domain controllers with minimal human intervention.
ARTEX Tool and Its Capabilities
ARTEX, a multi-agent platform developed in Go, was originally designed for penetration testing but has been co-opted by malicious actors, including suspected state-sponsored groups. Although the code was removed from GitHub in October 2026 due to misuse, it continues to circulate through various community forks like ScopeWeaver and a commercial version known as ARTEX PRO.
Security researchers from Google Cloud’s Threat Intelligence Group and Mandiant have been monitoring the use of ARTEX since August 2026. They have identified its deployment in attacks targeting sectors such as government, technology, chemicals, manufacturing, and telecommunications. Microsoft has also connected the tool to a China-linked group targeting Microsoft 365 tenants with stolen ConnectWise credentials.
Mechanics of the ARTEX Attacks
ARTEX operates by dividing tasks among six sub-agents. Attackers input goals and stolen credentials, which the framework translates into executable commands. In many instances, attackers provided ARTEX with legitimate login details to execute advanced stages of the attack.
Once inside a network, ARTEX executed PowerShell scripts on domain controllers and federation servers, enumerating usernames and service accounts, and examining Active Directory configurations. It was able to map extensive security accounts, pulling data from over 110,000 Active Directory objects in one instance.
Kerberoasting, a critical phase of the attack, involved requesting service tickets associated with service names that attackers could later crack offline to retrieve passwords. This process mirrors the Ghost SPN Kerberoasting method but is automated by ARTEX. The tool also performed DCSync operations to extract domain controller hashes and other sensitive credentials, posing a significant security risk.
Impact and Defense Strategies
ARTEX’s speed is unmatched by human attackers, with some actions occurring in mere seconds. Despite its efficiency, the tool’s operations are often noisy, generating numerous log events that can alert defenders. For instance, during one operation, it created 240 log events while attempting to deploy web shells, highlighting a lack of stealth in favor of speed.
Google has linked ARTEX activities to the group UNC7228, which overlaps with Microsoft’s identified actor STORM-0940. These actors have demonstrated rapid network penetration, achieving deep access in as little as 15 minutes.
Defenders are advised to focus on isolating administrative systems, using ephemeral credentials, and segmenting networks to mitigate these threats. Monitoring for unusual activities is crucial, as traditional static indicators may not detect attacks utilizing legitimate credentials and administrative tools.
In conclusion, while ARTEX AI does not introduce new attack methods, it significantly reduces the time needed to execute them, posing a growing challenge for cybersecurity professionals. Ongoing vigilance and adaptive defense measures remain essential in combating these advanced threats.
