ARTEX: Agentic AI penetration testing framework used in the wild

ARTEX is an open-source, multi-agent penetration testing framework written in Go that has been adopted by threat actors for malicious operations since its public release in July 2026. The framework utilizes LLM-based planning and worker agents to automate target mapping, credential harvesting, webshell deployment, and lateral movement. It has been used against cloud services such as Microsoft Graph by leveraging stolen authentication material or compromised application credentials. The use of AI agents enables rapid execution of command sequences and repeated attempts, significantly increasing the scale, noise, and persistence of attacks.

Attack Chain

1. Initial access via stolen application credentials, consented third-party apps, or compromised valid accounts.
2. Deployment of agentic AI framework (ARTEX) to interact with target environments.
3. Planning agents map the target environment and identify potential breach paths.
4. Worker agents execute offensive tasks including scanning and credential access.
5. Webshell deployment and command execution on target hosts (e.g., SQL Server).
6. Rapid command sequencing and repeated variants to bypass defenses and move laterally.
7. Automated recording of discovered assets and vulnerabilities in a graph structure.

Impact

Observed impact includes the compromise of cloud backup services and financial organizations. Attackers have demonstrated the ability to conduct credential theft, webshell deployment, and lateral movement at a significantly higher scale and velocity than manual operations.

Recommendation

• Audit service principals and enterprise applications in Microsoft Entra ID; remove unused app consents and review credential additions or role assignments since September 2026.
• Apply Conditional Access policies to workload identities to restrict application sign-ins to expected locations.
• Alert on application sign-ins that utilize scripted user agents or authentication failure rates exceeding established baselines.
• Implement automated first-response playbooks to contain attacks involving privileged access, such as revoking credentials or disabling compromised service principals.
• Hunt for temporary files following the naming pattern 'i<intentID>[variant]_<purpose>.<ext>' (e.g., i12345_b2.ps1) and paths containing 'artx', especially within C:\Windows\Temp.