Attackers use ARTEX and AI red-team tools in intrusions
Original title: ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know
Unit 42 counted 609 internet-facing ARTEX hosts and 1,323 running CyberStrikeAI as of October 2026.
Unit 42 says attackers are using ARTEX, CyberStrikeAI, and similar AI red-team tools to run autonomous intrusion attempts. Its incident response team found ARTEX consoles or related infrastructure on attacker servers, and threat hunting tracked a coordinated campaign against customer cloud environments, including retail and consulting. The firm says operators reached cloud access through public password-reset pages and exposed APIs without exploiting a software vulnerability.
Unconfirmed: Victim organizations are not named, and the report is Unit 42's observations.
- Twenty-one hosts were running both ARTEX and CyberStrikeAI.
- Unit 42 reviewed 14 tools across four red-team activity categories.
- The ARTEX author closed the repository and stopped public development.
- A Cairn study generated hundreds of thousands of noisy requests from one IP.
Impact: Cloud access through exposed identity workflows and APIs
- 1.Discover and reduce internet-exposed edge assets that autonomous tools can find.
- 2.Update perimeter blocks for infrastructure hosting these red-team tools.
- 3.Use centralized logging to distinguish high-frequency agentic traffic.
- Products
- ARTEXCyberStrikeAICairn
- Organizations
- Unit 42
- AI models
- DeepSeek
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | evil.com | usernames before real ones, and placeholder values such as evil[.]com , test@example[.]com and deadbeefdeadbeefdeadbeef12 Paral |
From the original article
7 min read at unit42.paloaltonetworks.com
Learn what Unit 42 discovered about attacker use of AI-powered red team tools, and how to mitigate these attacks. The post ARTEX and AI-Powered Red Teaming Tools: What Defenders Need to Know appeared first on Unit 42.
By Cuong Dinh, Richard Emerson and Samantha Stallings · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.