Cyber attackers are now leveraging an open-source AI-driven tool named ARTEX to automate complex Active Directory intrusions, Kerberoasting, and lateral movement, significantly reducing the time needed for advanced network compromise.
What ARTEX Does and How It’s Being Deployed
ARTEX is a multi-agent penetration testing and command-and-control framework developed in Go. While it was originally intended for security assessments, threat actors have begun to exploit it to map Windows networks, harvest service account credentials, and pivot to domain controllers with minimal oversight. The tool splits tasks into six specialized sub-agents: operators provide a goal and compromised credentials, and ARTEX orchestrates everything that follows.
Once inside a target network, ARTEX executes PowerShell scripts aimed at domain controllers and federation servers. It inspects user accounts, managed service account configurations, and Active Directory Certificate Service templates, while pulling vast numbers of AD objects—one case saw over 110,000 objects accessed and membership in the Domain Admins group exposed. Critical operations like Kerberoasting are automated, allowing offline password cracking. Subsequent steps can include DCSync attacks, extracting krbtgt account keys, domain controller hashes, and cloud sync credentials.
Speed, Noise, and Detection Patterns
ARTEX operates at speeds no human can mimic: activities that can take hours are being completed in minutes, sometimes seconds. Single bursts of dangerous behavior have been recorded in the 2–25 second range, with cleanup or adjusted execution following tight timelines. In some incidents, adversaries achieved domain controller access within about four hours from initial infiltration—and once even in just 15 minutes.
But the rapid pace comes with trade-offs. ARTEX generates noisy and detectable traces—hundreds of log events during certain steps, overlapping agent activity, and some operations blocked by endpoint defenses or thwarted by system limitations. Security teams are seeing patterns in the indicators of compromise (IoCs): suspicious filename conventions (e.g. artex-probe-*), web shells planted via MySQL log file manipulation, and account names like “ArtexProbe” with plaintext passwords. Other notable tactics include using ‘curl’ commands to send output to rotating webhook URLs, setting general database logs to dump JSP files, and targeting `t3.micro` cloud instances as persistence jump points.
The spread of ARTEX is also being tracked across campaigns. One group, labeled UNC7228 (overlapping with Microsoft’s STORM-0940) consistently escalates access deeply within compromised environments. Microsoft has also linked the tool to a China-affiliated actor targeting Microsoft 365 tenants using ConnectWise credentials.
Recommendations for Defenders
Because ARTEX largely reuses known attack techniques—just automating them faster—defense remains anchored in established best practices. Suggested controls are isolating domain controllers and admin systems, enforcing short-lived credentials, reducing unnecessary privileges, segmenting networks, and alerting on anomalous behavior. Static indicators like signatures or hashes offer little coverage here, as ARTEX leverages valid accounts and standard administration tools to fly under the radar.
Despite its advanced automation, ARTEX isn’t infallible. Endpoint protection defeated some of its lateral movement attempts, and system constraints stalled others. Still, it represents a troubling advance in how quickly attackers can breach, explore, and dominate enterprise networks.
As AI-powered tooling becomes more accessible to both security testers and threat actors, the gap between detection and prevention narrows severely. Organizations need to assume automation in their adversary’s toolkit and boost their readiness accordingly. Watch for escalating use of AI agents in breach campaigns—and expect defenders who adapt fast to be the ones who win.
