Mandiant Observes Threat Actors Using ARTEX and Other Agentic Attack Frameworks
Summary
Google Threat Intelligence Group and Mandiant report actors using ARTEX, PentAGI and related LLM-driven frameworks for reconnaissance, privilege escalation, lateral movement and data theft, and recommend controls including short-lived credentials and behavioral dete
Key points
- Since late August 2026, GTIG and Mandiant say they observed threat actors using ARTEX, PentAGI, CAIRN and potentially custom frameworks during incident-response investigations.
- ARTEX activity included rapid bursts of automated actions, including 27 events in 23 seconds, and attempts to adapt scripts after errors.
- In one investigation, ARTEX used exposed application APIs and SQL commands in an attempt to write JSP webshells through MySQL log files; logs showed repeated iterations and eventual command output.
- Wiz associated an ARTEX campaign tracked by GTIG as UNC7228 with activity overlapping Microsoft-tracked actor STORM-0940; Wiz reported targeting, compromise and data theft affecting organizations in the US and Europe.
- PentAGI activity was mostly asset mapping and vulnerability scanning, but investigators also found artifacts indicating some operations advanced to intrusions and persistence.
- The article recommends restricting administrative control-plane access, using short-lived and least-privilege credentials, segmenting systems, limiting high-impact application functions, and monitoring behavioral changes and API bursts.
- GTIG assesses that current autonomous frameworks trade stealth for speed: observed activity was often noisy, but could complete attack tasks quickly.
Article Details
- Attack Vectors
- Threat actors used agentic offensive frameworks, including ARTEX and PentAGI, to automate reconnaissance, privilege escalation, lateral movement, and data collection.
- Operators supplied compromised credentials and used cloud management APIs to test permissions, enumerate resources, and access storage.
- ARTEX used exposed application APIs and SQL commands against a Linux Weaver OA server; activity included attempts to write JSP webshells through MySQL logs.
- Observed foothold activity included abusing Kudu administrative APIs and using curl to retrieve PowerShell and batch scripts, then send command results to webhook.site URLs.
- Reported post-compromise activity included Kerberoasting, DCSync, attempted Pass-the-Ticket and Pass-the-Hash lateral movement, and launching cloud instances as jump hosts.
- Frameworks performed bulk database and cloud-storage reads and prepared scripts for collecting data from EBS snapshots and volumes.
- ARTEX also abused legitimate application features, including notification functionality, to send test emails to more than 1,300 internal users.
- Defensive Notes
- Restrict administrative interfaces, cloud management APIs, and control-plane access to trusted networks and approved administrative paths; apply specific access controls to Kudu/SCM endpoints.
- Replace long-lived secrets with short-lived, workload-bound credentials and enforce least privilege for service principals, accounts, API keys, and cloud identities.
- Segment internet-facing applications from identity infrastructure and unrelated internal services; limit database privileges that permit operating-system command execution or arbitrary file writes.
- Apply rate limits and abuse controls to high-impact application features such as user creation, notifications, email, and sensitive-data access.
- Monitor identity and control-plane behavior for unusual authentication origins, API bursts, permission tests, account changes, and sudden increases in storage reads or writes.
- Correlate identity, control-plane, data-plane, endpoint, and network telemetry; monitor unexpected egress to webhook services, tunneling platforms, and other previously unseen destinations.
MITRE ATT&CK
T1003.006 · DCSyncARTEX executed DCSync scripts to steal the domain krbtgt key, cloud AD-sync credentials, and domain controller machine hashes.T1021.006 · Windows Remote ManagementARTEX attempted lateral movement using WinRM.T1059.001 · PowerShellARTEX staged and executed malicious PowerShell scripts and generated PowerShell enumeration scripts.T1069.002 · Domain GroupsARTEX listed Group Managed Service Accounts, mapped security principals, and retrieved the Domain Admins group.T1071.001 · Web ProtocolsARTEX used curl to post command results to rotating webhook.site URLs used for command-and-control activity.T1078 · Valid AccountsOperators supplied compromised credentials to ARTEX, which used them to access target systems and application APIs.T1087.002 · Domain AccountGenerated scripts validated domain usernames, enumerated Active Directory objects, and retrieved the Domain Admins group.T1105 · Ingress Tool TransferNative curl retrieved dynamically generated PowerShell and batch scripts onto a victim's Windows database server.T1190 · Exploit Public-Facing ApplicationARTEX used exposed application APIs and SQL activity against an external-facing Linux Weaver OA server to pursue command execution and database access.T1505.003 · Web ShellARTEX attempted to write JSP webshells by configuring MySQL logs to write JSP content to publicly accessible locations.T1530 · Data from Cloud StorageARTEX performed mass blob reads and attempted to collect data from cloud storage and EBS snapshots or volumes.T1550.002 · Pass the HashARTEX attempted lateral movement using Pass-the-Hash scripts.T1550.003 · Pass the TicketARTEX attempted lateral movement using Pass-the-Ticket scripts.T1558.003 · KerberoastingARTEX ran Kerberoasting scripts to harvest service tickets across compromised domains.T1578.002 · Create Cloud InstanceOperators launched persistent and ephemeral EC2 instances, including t3.micro instances used as jump hosts or for snapshot and volume collection.
Threat Actors
Storm-0940Microsoft tracks activity overlapping with the ARTEX-associated campaign that GTIG calls UNC7228. The article does not state that the names are aliases.UNC7228GTIG tracks an ARTEX-associated campaign as UNC7228; Wiz reported targeting, compromise, and data theft affecting multiple entities. The article says this activity overlaps with activity tracked separately as STORM-0940.
Malware
Honestcuelow-failure, easy to execute actions, particularly writing code, such as in malware families like HONESTCUE or PROMPTSPY using LLMs dynamically during execution to, for example, obfuscate payloads in differentPromptSpyeasy to execute actions, particularly writing code, such as in malware families like HONESTCUE or PROMPTSPY using LLMs dynamically during execution to, for example, obfuscate payloads in different ways in
Vendors
Amazon Web ServicesIn at least one operation, we observed 27 events in 23 seconds of active burst time, performing rapid probing of AWS permissions across different security groups.Google CloudUse Google Cloud Workload Identity Federation instead of long-lived service-account keys.MandiantSince this publication, GTIG and Mandiant have observed multiple threat actors abusing the open-source, agentic pentesting frameworks ARTEX, Hexstrike and CAIRN in incident response engagements to conduct a broad rangeMicrosoftFor example, the Wiz Research team has been tracking a campaign associated with ARTEX, which GTIG tracks as UNC7228, that overlaps with activity tracked by Microsoft as the PRC-nexus actor STORM-0940.VXControlDeveloped by VXControl, the framework is offered in an open source and commercial edition.
Products
AWSIn at least one operation, we observed 27 events in 23 seconds of active burst time, performing rapid probing of AWS permissions across different security groups.AzureDirectory reconnaissance, privilege escalation, target cloud-infrastructure profiling (such as harvesting Azure storage keys), to the synthesis and deployment of custom webshells.Azure App ServiceFor example, Azure App Service includes an administrative interface through Kudu Site Control Manager, or SCM, which supports application deployment and management functionality.Google CloudUse Google Cloud Workload Identity Federation instead of long-lived service-account keys.Google SecOpsGoogle SecOps customers have access to these broad category rules and more under the Mandiant Frontline Threats and Mandiant Hunting Rules rule pack.Linux Weaver OAIn one instance, supplied with valid credentials, ARTEX accessed an external-facing Linux Weaver OA web server to execute SQL commands via exposed API calls.Microsoft Active DirectoryGTIG has observed capabilities including automated Active Directory reconnaissance, privilege escalation, target cloud-infrastructure profiling (such as harvesting Azure storage keys), to the synthesis and deployment ofMySQLARTEX used an application-specific SQL API, accessible to the supplied-user credential, to modify the MySQL instance to write log files with a .jsp extension to publicly accessible locations.
Tools
AgentZeroGTIG has observed evidence of threat-actor experimentation with tools like the ZeroHollow inference service and the fully agentic framework AgentZero.ARTEXand Mandiant have observed multiple threat actors abusing the open-source, agentic pentesting frameworks ARTEX, Hexstrike and CAIRN in incident response engagements to conduct a broad range of actions across multipleARTEX PROvia community forks, including localized variations such as ScopeWeaver and a commercial version dubbed ARTEX PRO.Cairnmultiple threat actors abusing the open-source, agentic pentesting frameworks ARTEX, Hexstrike and CAIRN in incident response engagements to conduct a broad range of actions across multiple phases of the attackCobalt StrikeHistorically, cyber espionage and financially motivated threat actors have taken advantage of pentesting or red-teaming platforms built for security professionals to exploit systems, such as Cobalt Strike or Metasploit.Hexstrikehave observed multiple threat actors abusing the open-source, agentic pentesting frameworks ARTEX, Hexstrike and CAIRN in incident response engagements to conduct a broad range of actions across multiple phases ofMetasploit FrameworkHistorically, cyber espionage and financially motivated threat actors have taken advantage of pentesting or red-teaming platforms built for security professionals to exploit systems, such as Cobalt Strike or Metasploit.NmapAll the tools used by PentAGI are open-source pentesting tools available by default in Kali Linux (e.g., metasploit, nmap, SQLmap).PentAGIthreat actors actively operating popular open-source multi-agent pentesting platforms like ARTEX, PentAGI, CAIRN and other potentially custom harnesses within Mandiant incident response engagements; use of theseScopeWeavercontinues to proliferate globally via community forks, including localized variations such as ScopeWeaver and a commercial version dubbed ARTEX PRO.sqlmapAll the tools used by PentAGI are open-source pentesting tools available by default in Kali Linux (e.g., metasploit, nmap, SQLmap).ZeroHollowGTIG has observed evidence of threat-actor experimentation with tools like the ZeroHollow inference service and the fully agentic framework AgentZero.
Countries
Industries
AerospaceIn another instance, we observed PentAGI chained with proxy services to target the Aerospace sector.chemicals and materialsTheir operations collectively impacted organizations across government, technology, chemicals and materials, and manufacturing sectors in the US, alongside public reporting of ARTEX targeting the financial sector inEnterprise softwaretargeting, compromise, and data theft affecting multiple entities in the US and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industryFinancial sectormaterials, and manufacturing sectors in the US, alongside public reporting of ARTEX targeting the financial sector in Asia.GovernmentTheir operations collectively impacted organizations across government, technology, chemicals and materials, and manufacturing sectors in the US, alongside public reporting of ARTEX targeting the financial sector inIndustrial automationand data theft affecting multiple entities in the US and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals.Manufacturingentities in the US and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals.semiconductor manufacturing and designentities in the US and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals.TechnologyTheir operations collectively impacted organizations across government, technology, chemicals and materials, and manufacturing sectors in the US, alongside public reporting of ARTEX targeting the financial sector inTelecommunicationsacross the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals.