Hackers Use ARTEX AI Agents to Automate Active Directory Attacks, Kerberoasting, and Lateral Movement

Hackers are now using an open-source AI tool called ARTEX to run large parts of a network break-in on their own. The tool can map a Windows network, steal service account passwords, and try to spread to domain controllers with very little human help.

It does this in seconds, not hours. ARTEX is a multi-agent penetration testing and command-and-control platform written in Go. Security teams built this kind of tool for testing, but criminals and suspected state-linked groups have picked it up.

Its original author took the code down from GitHub in October 2026 because of the abuse, yet copies still spread through community forks, including ScopeWeaver and a paid version called ARTEX PRO.

Researchers at Google Cloud’s Google Threat Intelligence Group and Mandiant identified the activity during incident response work.

They have seen ARTEX used since late August 2026. Victims include organizations in government, technology, chemicals, manufacturing, and telecommunications.

Microsoft has also tied the tool to a China-linked group in a campaign against Microsoft 365 tenants that used stolen ConnectWise credentials.

Hackers Use ARTEX AI Agents

ARTEX splits the attack into six sub-agents. The attacker gives it a goal and some stolen credentials, and the framework turns that goal into commands. In several cases, the intruders handed ARTEX valid logins and told it to carry out the later stages.

Once inside, ARTEX ran PowerShell scripts against a domain controller and a federation server. These scripts checked usernames, listed managed service accounts, and reviewed Active Directory Certificate Services templates.

They also mapped thousands of security accounts across forests. In one case, the tool pulled more than 110,000 Active Directory objects and read the Domain Admins group.

Kerberoasting was a key step. ARTEX asked for service tickets for accounts tied to service names, which attackers can crack offline to recover passwords.

This is the same basic trick seen in the Ghost SPN Kerberoasting technique, but here a machine did the work. After an offline cracking pause, the tool ran DCSync scripts and took the domain krbtgt key, cloud sync credentials, and domain controller hashes.

Stealing these hashes is dangerous because it can lead to forged tickets, as we explained in our report on how attackers impersonate domain controllers.

ARTEX also tried to move onto domain controllers with Pass-the-Ticket, WinRM, Kerberos relay, and Pass-the-Hash scripts. It failed in one case because of Windows service token limits, and endpoint protection blocked the rest before defenders cut off the server.

Machine Speed, Noisy Traces, and Wider Trend

Google said the tool works at a speed no human could match. Single bursts of activity ran for about 2 to 25 seconds, and one case showed 27 events in 23 seconds. When a script was too large, ARTEX trimmed it and relaunched it in about 10 seconds.

Wiz tracks one ARTEX campaign that Google calls UNC7228, which overlaps with Microsoft’s STORM-0940. That actor often went from its first hacked account to deep system access in about four hours, and once in 15 minutes.

The tool is also sloppy. In one case it created 240 log events while trying to plant web shells through MySQL log files, and its sub-agents seemed to overwrite each other.

Google says ARTEX trades stealth for speed, which gives defenders something to catch. The trend is spreading, too. Another group used AI agents to reach domain admin, as seen when Aur0ra ransomware operators used Cursor agents.

Google says these tools do not change attack methods. They only cut the time needed to chain them together. Its advice is to isolate admin systems, use short-lived credentials, limit access, segment networks, and watch for odd behavior.

Google also says static indicators will miss much of this activity, because attackers use valid accounts and normal admin tools.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Use ARTEX AI Agents to Automate Active Directory Attacks, Kerberoasting, and Lateral Movement appeared first on Cyber Security News.