On the hunt for ARTEX: understanding agentic attacks in AWS environments

ARTEX is an AI-native penetration framework observed in October 2026 targeting AWS environments, focusing on financial data. It uses autonomous LLM agents to plan and execute attacks, exploiting compromised long-term IAM access keys to search CloudWatch logs for sensitive information. The attackers also abuse Amazon Cognito user pools via anonymous sign-ups and token collection. Hundreds of exposed ARTEX consoles were found, mainly in Mandarin and hosted in Singapore and Hong Kong. The framework is linked to the China-aligned threat actor Storm-0940 and features advanced post-exploitation capabilities such as automated resource discovery and credential harvesting across cloud environments.

• Crimson Collective: A New Threat Group Observed Operating in the CloudCampaign2025-10-10
• Trusted by Default: Qubole Cross-Account Access Abused in the WildMalware2026-11-09
• ARTEX abuse expands as cybercriminals target financial sectorMalware2026-11-07
• ARTEX: Agentic AsbestosMalware2026-11-06
• ARTEX Exposed: Infrastructure Behind the South Korea Bank HackMalware2026-11-04