CriticalAPT
Hackers Use ARTEX AI to Automate Enterprise Attacks at Machine Speed – Insights for Defenders
Cyber Security News·Source published ·1 min read
What happened?
AI-powered offensive frameworks are helping attackers move from stolen credentials to cloud privilege escalation, lateral movement, and data theft in minutes. Recent ARTEX campaigns show why organizations must rethink how they detect and stop automated intrusions. Cybercriminals and state-linked hacking groups are increasingly using an artificial intelligence-powered framework called ARTEX to automate complex attacks against enterprise networks, cloud platforms, and identity systems.
Key details
- Google Threat Intelligence Group and Mandiant published research on October 30, 2026 identifying ARTEX in Active Directory attacks and cloud reconnaissance.
- Microsoft linked ARTEX to Storm-0940, a China-state-aligned actor that used it to accelerate attacks via compromised ConnectWise credentials.
- CrowdStrike documented VAPOR PANDA using ARTEX against more than 200 organizations across 14 countries in an 11-day period.
- ARTEX can generate 27 events in 23 seconds while testing AWS permissions, showing rapid automated activity bursts.
What to look for
- Rapid IP rotation when blocked, with new addresses appearing within minutes and varied user-agent strings.
- Deployment of BLOODALCHEMY backdoor for persistent access after ARTEX-driven compromise.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.