What happened
On November 5, 2026, CERT-EU said it had observed several threat actors around the world using ARTEX and assessed that similar activity against its constituency highly likely involved the same framework. Google Threat Intelligence Group and Mandiant had previously reported that, since late August 2026, multiple actors used ARTEX and related frameworks during incident-response engagements for lateral movement, database exploitation and exfiltration preparation. The original ARTEX repository was removed in October 2026, but independent forks remain publicly available.
The agent framework is ARTEX, an open-source LLM-driven, multi-agent penetration-testing and offensive command-and-control platform. No underlying model or version was identified for the observed activity; ARTEX integrates external LLM providers chosen by operators. Operators define scope and objectives, supply compatible models and may provide compromised credentials; controls rely on configurable rules and model behaviour rather than hard technical enforcement. Observed ARTEX activity mechanically executed permission testing, SQL commands, webshell creation, account creation, cloud reconnaissance and exfiltration preparation.
Google observed ARTEX execution bursts lasting roughly 2 to 25 seconds, including 27 events in 23 seconds. Published artefacts include webshell candidates cl1217.jsp, f1219a.jsp and z1219.jsp; files matching artex-probe-*; account or password strings containing ArtexProbe; and command results sent through 491 rotating webhook.site URLs. Google’s published detections include Suspicious Webhook.Site Interaction, Suspicious Curl Invocation, Cmd Launching Curl and AWS Cloud Accounts Getcalleridentity.
Attribution posture: CERT-EU describes several actors, while Google links one ARTEX campaign to UNC7228 with overlap to Microsoft’s STORM-0940; the broader ARTEX activity is not attributed to one operator.
Why this matters now
ARTEX does not introduce a new class of authentication, cloud or application technique. It changes how quickly ordinary gaps can be tested, chained and retried. The observed activity used valid credentials, legitimate APIs, built-in administration functions and rapid error correction. That reduces the value of controls designed around a human attacker’s pace and increases the importance of constrained identities, private administration paths, egress controls and detection based on sequences and velocity.
The defensive decision is therefore broader than blocking a tool name. Public forks can change, operators choose their own model providers and static infrastructure may rotate. Organisations need telemetry joining identity, cloud control-plane, application administration, storage and network activity so rapid permission testing, write-read-delete sequences, account creation, webhook traffic and unexpected east-west movement are analysed as one attack chain. Internal use of comparable security agents also requires hard technical scope boundaries, approval controls and complete execution logging.
The decision for security leaders
Direct detection engineering to test the published behaviours across identity, application, cloud and egress telemetry. Prioritise rapid permission checks, unexpected Kudu or management-API use, sequential cloud validation calls, unusual webhook.site traffic, artex-probe-* filenames and bursts of account or configuration changes. Detection must correlate sequences rather than alert on each individually legitimate API call.
Reduce the blast radius available to automated tooling. Restrict management interfaces to trusted administrative paths, constrain service principals by network and workload, remove long-lived secrets, segment exposed applications from control planes and limit production-server egress. Where the organisation authorises AI-enabled penetration tools, require hard scope enforcement, explicit approvals and immutable execution logs rather than relying on model instructions.
Evidence of closure
- Detection tests alert on rapid permission probing and write-read-delete sequences.
- Control-plane policy blocks administration from untrusted networks.
- Credential inventory shows privileged workload secrets are short-lived and scoped.
- Red-team evidence proves automated chains cannot traverse control boundaries unchecked.
The Security.io assessment
The authoritative change is CERT-EU’s direct warning and assessment regarding its constituency, layered onto Google and Mandiant’s incident-response evidence. That combination supports a high-confidence conclusion that public agentic frameworks are being used operationally. It does not support treating every rapid intrusion as ARTEX, nor does it establish that one actor, model or campaign explains the full activity.
The current tradecraft appears noisy enough to expose behavioural signals, but velocity reduces the time between detection and consequence. A 23-second event burst can complete permission discovery before a human triages an alert. The cited Google report did not publish file hashes or fixed command-and-control IP addresses for the broader ARTEX activity. Static blocking is therefore supporting evidence; effective closure requires control-plane constraints, short-lived identities, egress governance and tested automated containment.
Questions for the morning meeting
- Can responders contain a valid-credential attack measured in minutes?
- Which control planes lack behavioural baselines?
- Where do long-lived machine credentials cross environment boundaries?
- Are authorised AI penetration tools governed by hard scope enforcement?