Hackers Use ARTEX AI Agents to Automate Active Directory Attacks
Original title: Hackers Use ARTEX AI Agents to Automate Active Directory Attacks, Kerberoasting, and Lateral Movement
Google and Mandiant report ARTEX used since late August 2026 in attacks across multiple sectors including government and tech.
Hackers employ the open-source ARTEX framework to automate Active Directory attacks, Kerberoasting, and lateral movement. The Go-based tool splits tasks into six sub-agents and runs reconnaissance, credential theft, and movement in seconds. Researchers identified activity since late August 2026 with victims in government, technology, chemicals, manufacturing, and telecommunications sectors; campaigns overlap UNC7228 and China-linked groups.
Unconfirmed: Tool ties to China-linked group per Microsoft; Google names UNC7228
- ARTEX splits attacks into six sub-agents
- Activity seen since late August 2026
- Kerberoasting used to steal service tickets
- Campaigns overlap with UNC7228
- Creates admin accounts and pulls AD objects quickly
Impact: Automated Active Directory attacks, credential theft via Kerberoasting, and lateral movement
- 1.Isolate admin systems
- 2.Use short-lived credentials
- 3.Segment networks
- ATT&CK
- T1558.003 KerberoastingT1021.001 Remote Services: Remote Desktop ProtocolT1550.002 Pass the Hash
- Products
- ARTEXActive Directory
- Threat actors
- UNC7228
- Organizations
- Google Threat Intelligence GroupMandiant
- Countries
- China
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | webhook.site | (SHA256/MD5) Not published None listed in the source Domain webhook.site Command output sent via curl to 491 rotating URLs Filename |
From the original article
4 min read at cybersecuritynews.com
Hackers are now using an open-source AI tool called ARTEX to run large parts of a network break-in on their own. The tool can map a Windows network, steal service account passwords, and try to spread to domain controllers with very little human help. It does this in seconds, not hours.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.