Datadog reports in-the-wild ARTEX agentic attacks on AWS environments
Original title: On the hunt for ARTEX: understanding agentic attacks in AWS environments
Operators used stolen IAM keys and public Cognito pools to hunt financial data, secrets, and account details.
In October 2026, Datadog observed ARTEX, an AI-native penetration framework, used against several AWS environments focused on financial data. Activity started with anonymous S3 reads, then compromised long-term IAM keys searching CloudWatch, or anonymous sign-ups on public Cognito pools followed by account enumeration. In early November, Datadog tied activity to a hosted console and found hundreds of internet-exposed consoles, often in Mandarin, including hosts in Singapore and Hong Kong. Microsoft has tied ARTEX to the China-aligned actor Storm-0940.
Unconfirmed: Microsoft's link of ARTEX to Storm-0940 is that company's attribution; operator task timeouts were not confirmed.
- The project went closed-source on October 8 after passing 12,000 forks.
- Consoles also appeared as ScopeWeaver, LUCK, and Guanlan SEC.
- Some versions exclude .gov, .gov.cn, .edu, and .edu.cn by default.
- Agents request nonexistent keys such as zzz_nonexistent_abc.txt before guessing.
- Workers run three at a time, with a planner heartbeat of at least 10 minutes.
Impact: Financial data, cloud secrets, and AWS account enumeration
- 1.Hunt CloudTrail for anonymous S3 GetObject calls before secret searches.
- 2.Review long-lived IAM access keys and public Cognito user pools.
- ATT&CK
- T1078.004 Valid Accounts: Cloud AccountsT1530 Data from Cloud Storage ObjectT1552 Unsecured CredentialsT1087.004 Account Discovery: Cloud Account
- Vendors
- Amazon
- Threat actors
- Storm-0940
- Malware
- ARTEXScopeWeaverLUCK
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | acme.com | , intents, facts and findings for a demo engagement against acme.com (click to enlarge) Command interception rules, written as r |
| domain | api.github.com | sign up: PreSignUp failed with error Invalid tenant domain: api[.]github[.]com. PreSignUp failed with error Invalid tenant domain: exa |
| domain | artex-hqheizfk.invalid | Up failed with error Invalid tenantDomain format: hxxps[://]artex-hqheizfk[.]invalid/x. Attributes did not conform to the schema: Type for att |
| domain | yecaoyun.com | 32 IP Zeofast Network - Hosting Provider 45.145.228[.]25 IP Yecaoyun[.]com, LUCIDACLOUD LIMITED - Hosting Provider artex-readonly/1. |
| domain | zeofast.cn | sed again from 103.54.154[.]40 , an address associated with zeofast[.]cn . This session widened the search, looking for file and s |
| ipv4 | 102.216.154.102 | rovider 154.36.136[.]23 IP NetLab Global - Hosting Provider 102.216.154[.]102 IP Vilcom Networks Limited - ISP in Kenya 82.158.88[.]233 |
| ipv4 | 103.54.154.32 | urkey 103.54.154[.]40 IP Zeofast Network - Hosting Provider 103.54.154[.]32 IP Zeofast Network - Hosting Provider 45.145.228[.]25 IP |
| ipv4 | 103.54.154.40 | . On October 20, the same long-term key was used again from 103.54.154[.]40 , an address associated with zeofast[.]cn . This session |
| ipv4 | 154.36.136.197 | rovider 154.64.252[.]77 IP NetLab Global - Hosting Provider 154.36.136[.]197 IP NetLab Global - Hosting Provider 154.36.136[.]23 IP Ne |
| ipv4 | 154.36.136.23 | ovider 154.36.136[.]197 IP NetLab Global - Hosting Provider 154.36.136[.]23 IP NetLab Global - Hosting Provider 102.216.154[.]102 IP |
| ipv4 | 154.64.252.77 | rces. One example came as a spike on October 26 and 27 from 154.64.252[.]77 . The observed SignUp calls sometimes named the tool in t |
| ipv4 | 169.128.55.214 | deactivated or removed Appendix Indicators IOC IOC Type ASN 169.128.55[.]214 IP Caelus Technology LLC - Hosting Provider 154.64.252[.] |
| ipv4 | 45.145.228.25 | vider 103.54.154[.]32 IP Zeofast Network - Hosting Provider 45.145.228[.]25 IP Yecaoyun[.]com, LUCIDACLOUD LIMITED - Hosting Provider |
| ipv4 | 82.158.88.233 | 102.216.154[.]102 IP Vilcom Networks Limited - ISP in Kenya 82.158.88[.]233 IP Zenixcloud - Hosting Provider 88.229.22[.]232 IP TTNet |
| ipv4 | 88.229.22.232 | P in Kenya 82.158.88[.]233 IP Zenixcloud - Hosting Provider 88.229.22[.]232 IP TTNet A.S. (Turk Telekom) - ISP in Turkey 103.54.154[. |
From the original article
8 min read at securitylabs.datadoghq.com
We share in-the-wild activity from ARTEX, an AI-native penetration framework, against AWS environments, including CloudWatch log hunting with compromised access keys and abuse of public Cognito user pools.
By @datadoghq · securitylabs.datadoghq.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.