EN PT-BR
← Voltar ao feed
high financial

ARTEX AI pentest framework drives agentic attacks on AWS via leaked access keys and public Cognito pools

1 fonte(s) · 1 atualização(ões) · publicado 08/11/2026 21:00 · coletado há 1 hora

ARTEX, an AI-native penetration framework in which a team of LLM agents plans and runs an intrusion toward an operator-defined objective, was observed by Datadog in October 2026 against several AWS environments, with financial data as the main target. Two entry points appeared: long-term IAM access keys that had already leaked, and anonymous self-registration on public Amazon Cognito user pools. After access, the agent searched CloudWatch logs for financial terms, file paths and secrets, and enumerated AWS resources. Datadog tied the activity to hosted ARTEX consoles, hundreds of which are exposed online, often with Chinese-language interfaces and hosting in Singapore and Hong Kong. The article reports that Microsoft links the framework to Storm-0940, a China-aligned actor. Criticity is high rather than critical: the article reports no confirmed mass breach, the AWS entry depends on credentials that were already compromised, and the Cognito attempts mostly failed for lack of permissions.

Detalhes técnicos

  • The platform is a hosted web console; operators supply API keys for chosen inference providers and can route through the openai, openai-responses and anthropic request formats, switching provider when a key is cut off (the article reports this).
  • Architecture: a planner dispatches intents to workers, three at a time by default; work is recorded on a blackboard graph; tasks carry allow and deny constraints, a timeout with wrap-up, and a planner heartbeat of at least 10 minutes. Command interception rules can allow, deny or ask a human, and some versions exclude .gov, .gov.cn, .edu and .edu.cn by default.
  • The Go backend with a Next.js console is described by Brandefense (brandefense.io).
  • Pre-attack reconnaissance: sessions open with unauthenticated S3 reads (CloudTrail userIdentity type AWSAccount with accountId anonymous), and the agent probes placeholder names such as a nonexistent path and nonexistent-looking S3 keys to learn what 'not found' looks like before fuzzing.
  • Activity cluster 1 (leaked long-term keys): the most frequent call was FilterLogEvents, always with a limit of 1000, searching for cryptocurrency firms, hedge funds and financial institutions. On October 20 the same key was reused from 103.54.154[.]40, linked to zeofast[.]cn, to look for file links, internal secrets, internal IP addresses and database information.
  • Activity cluster 2 (Cognito): SignUp calls from 154.64.252[.]77 on October 26 and 27, some with the user agent 'Mozilla/5.0 ARTeX'. A PreSignUp Lambda trigger validated tenant domains and rejected the agent's attempts. After registration the agent ran SignUp, InitiateAuth, RespondToAuthChallenge, GetUser and GetTokensFromRefreshToken, traded the tokens for short-term AWS credentials in a CognitoIdentityCredentials session, and tried read-only discovery calls, all of which failed because the identity pool's authenticated role lacked permissions.

Remediação

  • Hunt for the ARTEX user agents and the source IPs listed above, then look for large volumes of AccessDenied errors, multi-region enumeration with long-term keys, anomalous S3 object enumeration, and credentials from EC2 instance roles used from non-AWS IPs.
  • Enable the Datadog Cloud SIEM out-of-the-box detections for anomalous AccessDenied counts, multi-region enumeration with long-term keys, Secrets Manager retrieval by unfamiliar IAM users, and Tor client IPs in AWS.
  • Rotate long-term access keys every 90 days or less, remove keys inactive for over a year, and deactivate or delete unused credentials, using the Datadog Cloud Security Misconfigurations rules.
  • Review Cognito user pools that allow open self-registration, the PreSignUp triggers that guard them, and the permissions granted to unauthenticated identity pool roles.

Linha do tempo

  1. securitylabs.datadoghq.com ↗ · pub. 08/11/2026 21:00 · coletado 09/11 16:01 primeiro registro

    ARTEX AI pentest framework drives agentic attacks on AWS via leaked access keys and public Cognito pools

    ler a análise desta fonte

    ARTEX, an AI-native penetration framework in which a team of LLM agents plans and runs an intrusion toward an operator-defined objective, was observed by Datadog in October 2026 against several AWS environments, with financial data as the main target. Two entry points appeared: long-term IAM access keys that had already leaked, and anonymous self-registration on public Amazon Cognito user pools. After access, the agent searched CloudWatch logs for financial terms, file paths and secrets, and enumerated AWS resources. Datadog tied the activity to hosted ARTEX consoles, hundreds of which are exposed online, often with Chinese-language interfaces and hosting in Singapore and Hong Kong. The article reports that Microsoft links the framework to Storm-0940, a China-aligned actor. Criticity is high rather than critical: the article reports no confirmed mass breach, the AWS entry depends on credentials that were already compromised, and the Cognito attempts mostly failed for lack of permissions.

    Technical Details

    • The platform is a hosted web console; operators supply API keys for chosen inference providers and can route through the openai, openai-responses and anthropic request formats, switching provider when a key is cut off (the article reports this).
    • Architecture: a planner dispatches intents to workers, three at a time by default; work is recorded on a blackboard graph; tasks carry allow and deny constraints, a timeout with wrap-up, and a planner heartbeat of at least 10 minutes. Command interception rules can allow, deny or ask a human, and some versions exclude .gov, .gov.cn, .edu and .edu.cn by default.
    • The Go backend with a Next.js console is described by Brandefense (brandefense.io).
    • Pre-attack reconnaissance: sessions open with unauthenticated S3 reads (CloudTrail userIdentity type AWSAccount with accountId anonymous), and the agent probes placeholder names such as a nonexistent path and nonexistent-looking S3 keys to learn what 'not found' looks like before fuzzing.
    • Activity cluster 1 (leaked long-term keys): the most frequent call was FilterLogEvents, always with a limit of 1000, searching for cryptocurrency firms, hedge funds and financial institutions. On October 20 the same key was reused from 103.54.154[.]40, linked to zeofast[.]cn, to look for file links, internal secrets, internal IP addresses and database information.
    • Activity cluster 2 (Cognito): SignUp calls from 154.64.252[.]77 on October 26 and 27, some with the user agent 'Mozilla/5.0 ARTeX'. A PreSignUp Lambda trigger validated tenant domains and rejected the agent's attempts. After registration the agent ran SignUp, InitiateAuth, RespondToAuthChallenge, GetUser and GetTokensFromRefreshToken, traded the tokens for short-term AWS credentials in a CognitoIdentityCredentials session, and tried read-only discovery calls, all of which failed because the identity pool's authenticated role lacked permissions.

    Remediation

    • Hunt for the ARTEX user agents and the source IPs listed above, then look for large volumes of AccessDenied errors, multi-region enumeration with long-term keys, anomalous S3 object enumeration, and credentials from EC2 instance roles used from non-AWS IPs.
    • Enable the Datadog Cloud SIEM out-of-the-box detections for anomalous AccessDenied counts, multi-region enumeration with long-term keys, Secrets Manager retrieval by unfamiliar IAM users, and Tor client IPs in AWS.
    • Rotate long-term access keys every 90 days or less, remove keys inactive for over a year, and deactivate or delete unused credentials, using the Datadog Cloud Security Misconfigurations rules.
    • Review Cognito user pools that allow open self-registration, the PreSignUp triggers that guard them, and the permissions granted to unauthenticated identity pool roles.