Hackers weaponise AI pentest tool ARTEX to automate break-ins

Attackers are widely abusing ARTEX, an open-source AI penetration-testing tool, to automate intrusions into corporate networks, Cybersecurity News reported. Google Threat Intelligence Group has confirmed ARTEX-based attacks since late August, hitting government, technology, chemical, manufacturing and telecom organisations.

ARTEX was built for security teams to run penetration tests, but criminal and state-linked groups have adopted it for attacks. According to the report, an attacker only needs to enter a target and stolen credentials; ARTEX then generates and runs the attack commands itself, splitting the work across six sub-agents.

Google reported one case in which ARTEX handled 27 tasks in 23 seconds. In another, an organisation tracked by Google-owned Wiz was penetrated deep into a system about 4 hours after the first account compromise. One case saw more than 110,000 pieces of information taken from Active Directory, and Kerberoasting was also used.

Microsoft said a China-linked group used ARTEX in attacks on Microsoft 365. The tool is not stealthy: one case produced 240 log events, according to the article.

In October, the ARTEX developer removed the code from GitHub after repeated abuse, but copies and a paid version called ARTEX Pro are still running.

Countermeasures

Google named separating admin systems, short-lived credentials, restricted access rights and anomaly monitoring as countermeasures.