Unit 42 Details ARTEX-Linked Intrusions and AI Red-Team Tactics
Summary
Unit 42 describes ARTEX-linked intrusion attempts targeting exposed password-reset workflows and APIs to reach cloud environments, reports 1,323 hosts running CyberStrikeAI and 609 running ARTEX, and outlines observed behaviors and defenses.
Key points
- Unit 42 investigated multiple intrusions involving an ARTEX console, associated infrastructure, or user agents, and tracked a coordinated campaign against customer cloud environments.
- As of October 2026, Unit 42 identified 1,323 internet-facing hosts running CyberStrikeAI and 609 running ARTEX; 21 hosts ran both.
- Observed activity targeted public password-reset pages and exposed APIs, using credentials and trust relationships to reach cloud environments; Unit 42 said the activity did not exploit a software vulnerability.
- Behavioral indicators included rapid retries after failed requests, validation of more than 200 client secrets in about three minutes, and repeated write-then-delete storage tests.
- In a study of Cairn, Unit 42 observed hundreds of thousands of high-frequency requests across multiple edge protocols from a single origin IP.
- In one engagement, an attacker switched to a desktop browser for a password reset and first token request, suggesting possible human involvement or browser automation.
- Recommended defenses include removing exposed API specifications and source maps, requiring authentication on write endpoints, hardening self-service flows, protecting credentials, and hunting for operator behavior.
Article Details
- Attack Vectors
- ARTEX-driven intrusion attempts targeted public password-reset pages, exposed APIs, identity workflows, and cloud environments.
- Attackers downloaded credentials or client secrets, validated more than 200 client secrets in about three minutes, and used credentials to reach cloud resources.
- Observed activity included high-frequency requests, retries after failed requests, parallel probing of exposed systems, and repeated polling.
- Defensive Notes
- Remove public OpenAPI specifications, source maps, and configuration files containing tokens or client IDs from internet-facing applications.
- Require authentication on every write endpoint, including development and staging APIs; rate-limit and bot-protect registration, password-reset, and verification-code endpoints.
- Protect federated identities, remove long-lived cloud keys, keep administrator credentials out of provisioning records, use a secrets manager, and enforce least privilege.
- Continuously discover and reduce exposed assets; use perimeter telemetry and centralized logging to identify and block high-frequency automated traffic.
- Hunt for canary usernames, first use of a cloud key from a new IP address, write-then-delete storage tests, and early probing that precedes later intrusion activity.
MITRE ATT&CK
T1078 · Valid AccountsThe article reports attackers using stolen credentials to reach cloud environments and acting on a stolen credential within about a minute of finding it.T1110 · Brute ForceUnit 42 described high-frequency automated activity as brute-force agentic traffic, with repeated requests and retries observed across exposed systems.
Products
Tools
AIxVulnDeepAudit, AIxVulnARLARL, ARL-Next, Scope Sentry, Nemo, XingRin, OpenEASDARL-NextARL, ARL-Next, Scope Sentry, Nemo, XingRin, OpenEASDARTEXA rapidly expanding ecosystem of AI-enabled tools such as ARTEX and CyberStrikeAI — marketed for red teaming and penetration testing — are being used by attackers to execute offensive operations autonomously.AutoHunterCyberStrikeAI, ARTEX, Cairn, PentAGI, AutoHunterCairnCyberStrikeAI, ARTEX, Cairn, PentAGI, AutoHunterCyberStrikeAIA rapidly expanding ecosystem of AI-enabled tools such as ARTEX and CyberStrikeAI — marketed for red teaming and penetration testing — are being used by attackers to execute offensive operations autonomously.DeepAuditDeepAudit, AIxVulnNemoARL, ARL-Next, Scope Sentry, Nemo, XingRin, OpenEASDOpenEASDARL, ARL-Next, Scope Sentry, Nemo, XingRin, OpenEASDPentAGICyberStrikeAI, ARTEX, Cairn, PentAGI, AutoHunterScope SentryARL, ARL-Next, Scope Sentry, Nemo, XingRin, OpenEASDXingRinARL, ARL-Next, Scope Sentry, Nemo, XingRin, OpenEASD
Industries
ConsultingSeparately, Unit 42 Managed Threat Hunting tracked a coordinated ARTEX campaign against customer cloud environments in sectors worldwide, including retail and consulting.RetailSeparately, Unit 42 Managed Threat Hunting tracked a coordinated ARTEX campaign against customer cloud environments in sectors worldwide, including retail and consulting.