ARTEX Agentic Hacking Framework: What GTIG Found

artex pentagi agentic-ai ai-security threat-intelligence gtig mandiant storm-0940 detection-engineering security-leadership news

November 1, 2026 · PlayCISO · Updated Nov 1, 2026

TL;DR · the short version

On 30 October 2026 Google Threat Intelligence Group (GTIG) and Mandiant reported that, since late August 2026, multiple threat actors have used open-source agentic pentesting frameworks, chiefly ARTEX and PentAGI, to run large parts of real intrusions: reconnaissance, privilege escalation, lateral movement, database exploitation and exfiltration preparation. ARTEX worked in bursts of roughly 2 to 25 seconds and was forensically noisy. One campaign, tracked by GTIG as UNC7228 and overlapping with Microsoft's Storm-0940, typically reached deep system access about four hours after the first compromised account, per Wiz. Mandiant's defence is five familiar layers: control-plane isolation, short-lived credentials, hardened configurations, guardrails on business features and behavioural detection.

Put it into practice

How ready are you for a machine-speed intrusion?

Answer 23 questions across Mandiant's five defensive layers plus detection and response speed. Get a score per area, a prioritised fix list and a board summary.

Open the readiness scorecard

This post references: https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks

On 30 October 2026, Google Threat Intelligence Group (GTIG) and Mandiant reported that multiple threat actors have been running open-source agentic offensive frameworks, chiefly ARTEX and PentAGI, inside real intrusions since late August 2026. Given stolen credentials, the agents carried out reconnaissance, privilege escalation, lateral movement, database exploitation and exfiltration preparation in bursts of seconds. GTIG says the techniques are old; the speed is new.

Who this is for: CISOs, SOC and detection leads, cloud and identity teams.

Based on the GTIG/Mandiant report of 30 October 2026, with supporting detail from Wiz (22 October), Microsoft (21 October) and CrowdStrike (7 October). PlayCISO is not affiliated with any of them. This post describes attacker behaviour only at the level needed to detect it.

Confirmed vs not yet known

GTIG says: since late August 2026, threat actors have operated ARTEX, PentAGI, CAIRN and possibly custom harnesses in Mandiant incident response engagements, corroborated by GTIG research telemetry. Users span financially motivated extortion groups and suspected espionage operators.

Mandiant observed: ARTEX execution sequences in bursts of roughly 2 to 25 seconds; command-and-control over 491 rotating webhook.site URLs; enumeration of more than 110,000 Active Directory objects; an internal notification feature abused to email more than 1,300 users.

Wiz reports (as cited by GTIG): a campaign GTIG tracks as UNC7228 typically went from first compromised account to deep system access in about four hours, once in about 15 minutes, against firms in the US and Europe.

Microsoft tracks as Storm-0940 a China-state-aligned actor whose activity overlaps with UNC7228; Microsoft assesses it was responsible for the ConnectWise supply chain compromise.

Not yet known: how many organisations were hit in total, which victims GTIG's cases involve (it names sectors, not companies), and how many of the forks in circulation are being used offensively.

What happened

In September GTIG reported that advanced adversaries were moving from prompting LLMs to agentic workflows. Its new report says that shift has now reached live intrusions. GTIG and Mandiant say they saw several actors abuse the open-source agentic pentesting frameworks ARTEX, Hexstrike and CAIRN in incident response engagements, and that agents conducted "significant parts of the attack lifecycle", such as lateral movement, database exploitation and exfiltration preparation.

The authors are careful about what is new. The intrusions still relied on compromised credentials and unpatched systems. What changed, they write, is that agents "autonomously explore multiple attack paths, troubleshoot errors, and achieve objectives in seconds and minutes."

Timeline

Date	Event	Source
July 2026	A Chinese developer publishes ARTEX on GitHub	Wiz
At least August 2026	Earliest activity in the campaign GTIG tracks as UNC7228	GTIG, citing Wiz
Late August 2026	GTIG and Mandiant begin seeing actors operate ARTEX, PentAGI and CAIRN in incident response engagements	GTIG
Late August to early October 2026	A customised platform built on open-source PentAGI used for reconnaissance and scanning against organisations in Asia, including system integrators and telecoms firms	GTIG
8 September 2026	GTIG publishes "From Prompting to Autonomy" on adversaries moving to agentic workflows	GTIG
Late September to early October 2026	Campaign against South Korean financial organisations; ARTEX configuration files found on actor-controlled servers	CrowdStrike
8 October 2026	ARTEX developer makes the tool closed-source; more than 12,000 forks exist	Wiz
21 October 2026	Microsoft attributes the ConnectWise supply chain compromise to Storm-0940 and says it used ARTEX	Microsoft
22 October 2026	Wiz details an ARTEX-using actor, overlapping with Storm-0940, targeting IT and software vendors' identity providers	Wiz
30 October 2026	GTIG and Mandiant publish "ARTEX and Friends" with defensive guidance	GTIG

What ARTEX is, and who is using it

GTIG describes ARTEX as an autonomous, multi-agent, LLM-driven pentesting and offensive C2 platform written in Go with an embedded Next.js web console. It splits the attack lifecycle across six specialised sub-agents and uses frontier and open-source model APIs to turn tactical goals into commands. GTIG says the original repository was taken down by its creator in October 2026 because of widespread abuse, but forks continue, including ScopeWeaver and a commercial ARTEX PRO.

Users, per GTIG, include financially motivated groups using it for data theft extortion and suspected PRC-nexus clusters, affecting government, technology, chemicals and materials, and manufacturing organisations in the US. Wiz identified compromise and data theft at entities in the US and Europe in enterprise software, industrial automation, semiconductors and telecoms. Microsoft says Storm-0940's sign-in attempts reached more than 2,250 tenants, that most targeting failed but the actor still achieved privileged cloud persistence at many organisations, and that a successful authentication does not by itself confirm data was accessed.

The speed figures differ by source because they measure different things: Wiz's "about four hours" is first compromised account to deep system access; Microsoft's "under three hours" is to privileged cloud access in several cases.

What is different about a machine-speed intrusion

Mandiant compared ARTEX activity with a human operator's. In GTIG's words, the key differences are speed, persistence through errors and noise:

Bursts, not sessions. Intrusions had long pauses, but individual ARTEX execution sequences ran in compressed bursts of roughly 2 to 25 seconds. One burst showed 27 events in 23 seconds of AWS permission probing across security groups.
It fixes its own errors. When an exfiltration-preparation script failed as too large, ARTEX trimmed and relaunched it, deploying a 17-snapshot instance in about 10 seconds.
Sub-second cloud checks. It mapped what stolen Azure credentials could do, writing and deleting a tiny test blob in about 330 to 400 milliseconds and running an 8-second validation dry-run sweep across 11 Azure resource types. It tested AWS permissions with dry-run flags and placeholder IDs.
Trial and error, in the logs. Given valid credentials to an internet-facing web application, ARTEX used the application's own SQL API to probe for command execution. That generated 240 log events and errors that GTIG thinks came from sub-agents overwriting each other. It then abused database logging settings to try to write web-accessible JSP webshells, iterating on failures until one ran. (We do not reproduce the commands.)
Feature abuse instead of malware. It forced an application's notification system to send test emails to more than 1,300 internal users, then dropped to single-recipient tests. It found and used a writable admin flag to create admin accounts within minutes.
C2 through public services. On an internal Windows database server it used native curl to fetch generated scripts and post results back across 491 rotating webhook.site URLs.
Deep Active Directory reach. It ran Kerberoasting and, after an offline cracking pause, DCSync scripts; it enumerated more than 110,000 Active Directory objects and retrieved the Domain Admins group. Its lateral movement attempts towards domain controllers were stopped when endpoint protection blocked execution and defenders cut access.
Recognisable traces. ARTEX created files named with an "artex-probe" prefix and accounts with "ArtexProbe" in the name, and reused incrementing numeric markers in file names, account names, passwords and email subjects.

GTIG's outlook is that these frameworks currently "trade stealth for velocity": they are best suited to cases where getting detected costs the attacker little. It adds that detection and disruption are different functions, and that "simply detecting the attack in time does little to hinder objective completion."

Wiz describes the same pattern from the identity side: password-spray bursts with a median gap of exactly one second between attempts, bursts of 20 to 60 minutes, sessions of 24 to 30 hours, and new IP addresses within minutes of a block.

PentAGI

PentAGI, developed by VXControl in open-source and commercial editions, lets a user describe a target and a goal; agents then run open-source Kali Linux tools in isolated sandboxes, with a dozen-plus supported LLM backends. GTIG says most abuse it saw stayed at WHOIS asset mapping and vulnerability scanning, but some operations progressed to intrusion and persistence across multiple organisations. One customised platform built on it targeted organisations in Asia; another instance was chained with proxy services against the aerospace sector.

GTIG's seven maturity stages

GTIG maps how adversary use of LLMs has evolved, and where it expects it to go:

Stage	What it looks like	GTIG timeframe
1. Prompt-based use	Chatbot help writing and debugging malware, phishing and personas	End of 2025 to early 2026
2. LLMs embedded in malware	Malware such as HONESTCUE or PROMPTSPY calling an LLM during execution, for example to obfuscate payloads	Early 2026
3. LLM-enabled automation	Agents for discrete tasks and exploit research, humans in the loop, LLM proxies for OPSEC	Early 2026 to September 2026
4. Experimenting with autonomous frameworks	More lifecycle stages offloaded to LLM tooling; model APIs wired into tools and Telegram bots	Mid 2026 to September 2026
5. Multiple lifecycle stages run by LLM tooling in the wild	Fewer humans in the loop; messy, noisy, but successful	Current stage
6. Multi-agent, unsophisticated, little human interaction	Operator sets target and objective; framework runs the whole chain	Near term (1 to 3 months)
7. Sophisticated, fully autonomous	Autonomous and stealthier, via obscured infrastructure or self-hosted models	Medium term (3 to 6 months)

GTIG assesses with high confidence that cybercriminals will keep adopting these tools, because wider reach makes up for lower success rates, and says it has seen experimentation with the ZeroHollow inference service and the AgentZero framework.

Mandiant's five defensive layers

Mandiant's guidance starts from one idea: an organisation withstands this best when compromise of a single identity, credential or workload gives only limited access. Its layers, summarised:

Protect control planes. Restrict admin APIs, consoles, CI/CD, hypervisors, backup and firewall management to trusted networks. Treat application management interfaces such as Azure App Service Kudu/SCM as privileged: restrict SCM access, disable basic publishing authentication where not needed, consider run-from-package. Check yours with the Kudu hardening checklist.
Restrict identities and keys. Replace static AWS keys with IAM roles, Azure client secrets with Managed Identities, Google service-account keys with Workload Identity Federation, GitHub classic PATs with fine-grained PATs or Actions OIDC. Limit where non-human identities can authenticate from, restrict iam:PassRole, and automate secret scanning and rotation.
Harden configurations and reduce attack paths. Segment internet-facing tiers from identity and management systems; stop exposed workloads from initiating Kerberos, NTLM, LDAP, SMB, WinRM or RDP where not needed; strip database accounts of rights to write files or run OS commands; hide verbose errors; harden AD CS; enforce SMB and LDAP signing. Practise the AD side in the Kerberos attack lab.
Harden application functionality. Put rate limits, recipient limits and thresholds on business APIs that send email, create users or export data, and inventory high-impact admin capabilities before an incident.
Detect behavioural change. Baseline identities and workloads; alert on new authentication origins, control-plane bursts and data-plane anomalies; correlate events into sequences; control server egress and watch for webhook and OAST services; keep enough telemetry to know what normal looks like. Practise spotting machine-speed activity in the Human or Agent? lab.

Google says SecOps customers get coverage for this activity through rules including "Suspicious Webhook.Site Interaction", "Suspicious Curl Invocation", "Cmd Launching Curl" and "AWS Cloud Accounts Getcalleridentity".

What security leaders should do this week

Find internet-reachable admin paths, including app management endpoints like Kudu/SCM, and put them behind trusted networks.
List your 20 most powerful non-human identities, who owns each and whether its credential is long-lived. Start replacing the worst.
Block or alert on server egress to webhook and OAST services. 491 rotating webhook.site URLs is a pattern a simple first-contact rule would see.
Add a velocity rule for management API calls and permission tests per identity per minute. Rules tuned to human pace will miss 27 events in 23 seconds.
Put limits on bulk notification and email features in internal applications.
Pre-authorise on-call containment: disabling an identity and revoking its tokens should not wait for a meeting when access can be gained in 15 minutes. Measure your own number with Time to Domain Admin.
Hunt for the traces GTIG names: "artex-probe" files, "ArtexProbe" accounts, bursts of write-then-delete test objects. Build the plan with hunt plan review, and plant tripwires with the honeytoken placement planner.
Train the eye: the Human or Agent Lab shows what agent activity looks like next to a human's, and the agent egress containment lab practises cutting it off.
Score yourself against all of the above with the Agentic Attack Readiness Scorecard and take the summary to your board.

How this relates to CAIRN

GTIG lists CAIRN among the frameworks it saw abused but does not describe it in detail. We covered a researcher's earlier single-source report of an LLM-driven attack platform called Cairn in Operation CAIRN; GTIG's report does not say whether that is the same tool.

Frequently asked questions

What is ARTEX?

ARTEX is an open-source, multi-agent penetration testing and offensive command-and-control (C2) platform driven by large language models. GTIG describes it as written in Go with an embedded Next.js web console, splitting the attack lifecycle across six specialised sub-agents that turn high-level goals into machine commands. Wiz reports a Chinese developer published it on GitHub in July 2026.

Is ARTEX malware?

Not in the usual sense. ARTEX was released as a pentesting framework, much as Cobalt Strike and Metasploit were built for security professionals. GTIG and Mandiant say threat actors are abusing it in real intrusions. Treat its presence or its traces in your environment as an incident unless it is part of an authorised test.

Is ARTEX still on GitHub?

GTIG says the original repository was taken down by its creator in October 2026 because of widespread abuse, but the framework keeps spreading through community forks, including a localised variant called ScopeWeaver and a commercial version called ARTEX PRO. Wiz reports the developer made the tool closed-source on 8 October, by which time it had more than 12,000 forks.

Who is using ARTEX?

GTIG says financially motivated extortion groups and suspected cyber espionage operators, including suspected PRC-nexus clusters. One campaign, which GTIG tracks as UNC7228, overlaps with activity Microsoft tracks as the China-state-aligned actor Storm-0940. CrowdStrike separately reported an unattributed, likely financially motivated actor using ARTEX against South Korean financial organisations.

What is PentAGI?

PentAGI (Penetration Testing Artificial General Intelligence) is an autonomous pentesting framework developed by VXControl, offered in open-source and commercial editions. A user describes a target and a goal; a team of agents breaks the work into sub-tasks and runs open-source Kali Linux tools in isolated sandboxes. GTIG says most abuse it saw stayed at asset mapping and vulnerability scanning, but some operations reached intrusion and persistence.

How fast are agentic attacks?

GTIG says individual ARTEX execution sequences ran in bursts of roughly 2 to 25 seconds, including 27 events in 23 seconds of AWS permission probing. Wiz, as cited by GTIG, saw the UNC7228 actor typically move from a first compromised account to deep system access in around four hours, and once in about 15 minutes. Microsoft says Storm-0940 gained privileged cloud access in under three hours in several cases.

How do you detect agentic attacks?

Look at behaviour rather than static indicators, because agents mostly use valid credentials and normal APIs. Mandiant recommends baselining identities and workloads, alerting on new authentication origins, bursts of management API calls and permission tests, unusual storage access, and first contact from servers with webhook or OAST services, and correlating these into one sequence. GTIG also notes ARTEX is noisy: it generates many errors and log events, and uses recognisable naming.

How do you defend against AI-driven attacks?

Mandiant lists five layers: restrict control planes such as admin APIs and app management interfaces to trusted networks; replace long-lived secrets with short-lived, workload-bound credentials; harden configurations and segment application tiers; put rate and recipient limits on high-impact business functions; and detect behavioural change. These are long-standing controls; automation finds the gaps between them faster.

What is the difference between Hexstrike, CAIRN and ARTEX?

GTIG names all three as open-source agentic pentesting frameworks it has seen abused in incident response engagements, and lists CAIRN and PentAGI alongside ARTEX in its observations. The report gives detail on ARTEX and PentAGI only; it does not describe Hexstrike or CAIRN in depth.

Sources

How ready are you for a machine-speed intrusion?

Answer 23 questions across Mandiant's five defensive layers plus detection and response speed. Get a score per area, a prioritised fix list and a board summary.

Open the readiness scorecard