Introduction

Recent intrusions in which threat actors have been observed weaponizing agentic frameworks to execute highly-automated intrusions has put a spotlight on evolving adversarial use of LLMs. In our September 2026 report, Google Threat Intelligence Group (GTIG) noted that forward leaning adversaries were beginning to transition from basic prompting to agentic workflows and LLM-enabled automation.

Since this publication, GTIG and Mandiant have observed multiple threat actors abusing the open-source, agentic pentesting frameworks ARTEX, Hexstrike and CAIRN in incident response engagements to conduct a broad range of actions across multiple phases of the attack life cycle. This activity has been seen across the threat landscape, as noted in a recent Wiz report. The emergence of Artex and similar agentic offensive intrusion frameworks underscores a broader shift toward threat actor adoption of open source multi-agent offensive frameworks, as well as potentially custom agentic harnesses.

This represents a paradigm shift towards intrusions occurring at machine speed, with the automated chaining of complex attack paths scaling intrusions exponentially. While the mechanics of the intrusions remain the same, such as using compromised credentials and targeting unpatched systems, the speed and scale at which frameworks can exploit these known weaknesses introduces a new defensive challenge. Security teams, developers, and system administrators will need to fundamentally rethink defense strategies to counter scalable, autonomous software. We also provide defensive strategies from Mandiant Consulting. The defensive strategies suggested—control-plane isolation, short-lived credentials, least privilege, segmentation, and behavioral detection—are long-standing security best practices.

Observations in the Wild

We are seeing tools used by adversaries evolving towards autonomous agentic attacks. One way this is occurring is through suites of tools or frameworks designed for penetration testing (“pentesting”). These tools and frameworks orchestrate various agents using open source and frontier LLMs to automate various stages of intrusions. Historically, cyber espionage and financially motivated threat actors have taken advantage of pentesting or red-teaming platforms built for security professionals to exploit systems, such as Cobalt Strike or Metasploit. Today, adversaries are pivoting toward offensive frameworks powered by LLMs. While these frameworks have existed in the wild, they are now yielding success in intrusions in the wild, representing a critical evolution that increases both the speed and scale of intrusion activity.

Since late August 2026, we have observed threat actors actively operating popular open-source multi-agent pentesting platforms like ARTEX, PentAGI, CAIRN and other potentially custom harnesses within Mandiant incident response engagements; use of these platforms has been further corroborated by our research telemetry. In these incidents, we have observed agentic activity conducting significant parts of the attack lifecycle (e.g., lateral movement, database exploitation, exfiltration preparation). Evidence of in the wild usage of these frameworks marks a critical inflection point for defenders, as agents now autonomously explore multiple attack paths, troubleshoot errors, and achieve objectives in seconds and minutes. Coupled with continual advancements in underlying LLM capabilities, the acceleration in attack velocity and scale signals a notable shift in the threat landscape that fundamentally alters traditional intrusion dynamics.

ARTEX Framework

ARTEX is an autonomous, multi-agent LLM-driven pentesting and offensive command-and-control (C2) platform written in Go with an embedded Next.js web console. The framework was originally developed by the user Autumn-27 and released on GitHub. Although the original repository was taken down by its creator in October 2026 due to widespread threat actor abuse, the framework continues to proliferate globally via community forks, including localized variations such as ScopeWeaver and a commercial version dubbed ARTEX PRO. ARTEX abstracts the attack lifecycle across six specialized sub-agents. By leveraging APIs from frontier and open source models, the framework translates high-level tactical goals into actionable machine commands. GTIG has observed capabilities including automated Active Directory reconnaissance, privilege escalation, target cloud-infrastructure profiling (such as harvesting Azure storage keys), to the synthesis and deployment of custom webshells.

Since late August 2026, ARTEX has been adopted by a diverse range of threat actors across the motivational spectrum, including both financially motivated extortion groups and suspected cyber espionage operators. For example, the Wiz Research team has been tracking a campaign associated with ARTEX, which GTIG tracks as UNC7228, that overlaps with activity tracked by Microsoft as the PRC-nexus actor STORM-0940. The research has expanded Wiz’s understanding of this campaign beyond the October IT focused activity with activity now dating back to at least August 2026. Wiz identified the targeting, compromise, and data theft affecting multiple entities in the US and Europe across the enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications industry verticals. This actor has moved extremely quickly, typically moving from their first compromised account to deep system access in around four hours and in one case as rapidly as 15 minutes. They have also customized their tooling to take advantage of victim-specific setups and fallen back to open proxies if their initial infrastructure was blocked.

Demonstrating broader adoption of ARTEX, GTIG and Mandiant observed multiple other threat actors using ARTEX for post-compromise reconnaissance, lateral movement, and privilege escalation in incident response investigations. This includes financially motivated threat actors who used the framework to facilitate data theft extortion, and additional suspected PRC-nexus clusters. Their operations collectively impacted organizations across government, technology, chemicals and materials, and manufacturing sectors in the US, alongside public reporting of ARTEX targeting the financial sector in Asia.

In several cases, adversaries provided ARTEX with compromised credentials for the targeted organization, and instructed the framework to execute subsequent stages of the attack lifecycle. Analysis of these intrusions reveals key differences between activity conducted by the ARTEX framework and that of a human operator:

Based on log files and timestamps, we identified bursts of activity that would be highly irregular for a human operator. While each of the intrusions exhibited extended pauses during operational phases, individual ARTEX execution sequences ran in compressed bursts of roughly 2 to 25 seconds. In at least one operation, we observed 27 events in 23 seconds of active burst time, performing rapid probing of AWS permissions across different security groups. While preparing potential exfiltration scripts, ARTEX was capable of successfully adapting to errors quoting “script too large” by trimming the script and relaunching it to successfully deploy a 17-snapshot instance in approximately 10 seconds.

Based on log files and timestamps, we identified bursts of activity that would be highly irregular for a human operator. While each of the intrusions exhibited extended pauses during operational phases, individual ARTEX execution sequences ran in compressed bursts of roughly 2 to 25 seconds. In at least one operation, we observed 27 events in 23 seconds of active burst time, performing rapid probing of AWS permissions across different security groups. While preparing potential exfiltration scripts, ARTEX was capable of successfully adapting to errors quoting “script too large” by trimming the script and relaunching it to successfully deploy a 17-snapshot instance in approximately 10 seconds.

Compared to a competent human operator, ARTEX achieved code execution in a far more forensically noisy manner, relying on rapid, iterative trial-and-error. In one instance, supplied with valid credentials, ARTEX accessed an external-facing Linux Weaver OA web server to execute SQL commands via exposed API calls. Using legitimately-exposed application-specific API calls, ARTEX was able to achieve partial command-execution to conduct further reconnaissance despite hitting technical complexities. However, this process generated 240 log events and exhibited errors potentially caused by multiple sub-agents overwriting one another while pursuing the same objective.

Compared to a competent human operator, ARTEX achieved code execution in a far more forensically noisy manner, relying on rapid, iterative trial-and-error. In one instance, supplied with valid credentials, ARTEX accessed an external-facing Linux Weaver OA web server to execute SQL commands via exposed API calls. Using legitimately-exposed application-specific API calls, ARTEX was able to achieve partial command-execution to conduct further reconnaissance despite hitting technical complexities. However, this process generated 240 log events and exhibited errors potentially caused by multiple sub-agents overwriting one another while pursuing the same objective.

In an attempt to pivot from a database-execution context to a system-execution context, ARTEX used an application-specific SQL API, accessible to the supplied-user credential, to modify the MySQL instance to write log files with a .jsp extension to publicly accessible locations. The SQL-commands executed were likely intended to poison MySQL logs into writing web-accessible JSP webshells.

In an attempt to pivot from a database-execution context to a system-execution context, ARTEX used an application-specific SQL API, accessible to the supplied-user credential, to modify the MySQL instance to write log files with a .jsp extension to publicly accessible locations. The SQL-commands executed were likely intended to poison MySQL logs into writing web-accessible JSP webshells.

Using the API, ARTEX ran SET GLOBAL general_log_file = '<path to webshell>’ followed by SET GLOBAL general_log = 1; subsequent SQL commands were written to the filepath defined in general_log_file. ARTEX then ran SQL SELECT statements in the form `SELECT '<% [webshell content] %>'`. Due to how the underlying Java web servlet handles JSP files, the Java code in the '<% %>' gets parsed and compiled into the process memory space, providing means of execution.

Using the API, ARTEX ran SET GLOBAL general_log_file = '<path to webshell>’ followed by SET GLOBAL general_log = 1; subsequent SQL commands were written to the filepath defined in general_log_file. ARTEX then ran SQL SELECT statements in the form `SELECT '<% [webshell content] %>'`. Due to how the underlying Java web servlet handles JSP files, the Java code in the '<% %>' gets parsed and compiled into the process memory space, providing means of execution.

Log activity shows multiple iterations of the above sequence, with ephemeral, somewhat-incremental file names (cl1217.jsp, f1219a.jsp, z1219.jsp) for each webshell candidate, each one executing a different command. Errors when trying to run the webshell (e.g. variable ‘t is already defined’) caused the webshell to fail and likely had ARTEX refactor its approach, writing several unique webshells, each with a different goal, some correcting previous errors until the .jsp webshells executed cleanly and returned valid command output to ARTEX.

Log activity shows multiple iterations of the above sequence, with ephemeral, somewhat-incremental file names (cl1217.jsp, f1219a.jsp, z1219.jsp) for each webshell candidate, each one executing a different command. Errors when trying to run the webshell (e.g. variable ‘t is already defined’) caused the webshell to fail and likely had ARTEX refactor its approach, writing several unique webshells, each with a different goal, some correcting previous errors until the .jsp webshells executed cleanly and returned valid command output to ARTEX.

In another case, during access-probing efforts, ARTEX generated files of various extension types with the filename artex-probe-*, where * carried five digit somewhat-incremental numbers. Based on our visibility, it’s difficult to comment on the exact significance of these numbers or how they increment. However, ARTEX was seen using similar incremental numeric markers within dropped file names, created account names, their passwords and within email subjects.

Observed ARTEX Activity Mapped along the phases of a targeted attack lifecycle

Phase of the attack lifecycle

Observed ARTEX Capabilities & Tradecraft

Initial Recon

Automatically mapped the effective permissions of obtained Azure credentials (SAS tokens, Service Principals, Kudu credentials, and Storage Account keys) using sub-second capability checks, test blob writes/deletes, and ARM deployment validation dry-run sweeps. This activity included bursts of rapid activity, with ARTEX writing and immediately deleting a tiny test blob in ~330–400 ms and running an 8-second ARM deployments/validate dry-run sweep across 11 Azure resource types.

Automatically mapped the effective permissions of obtained Azure credentials (SAS tokens, Service Principals, Kudu credentials, and Storage Account keys) using sub-second capability checks, test blob writes/deletes, and ARM deployment validation dry-run sweeps. This activity included bursts of rapid activity, with ARTEX writing and immediately deleting a tiny test blob in ~330–400 ms and running an 8-second ARM deployments/validate dry-run sweep across 11 Azure resource types.

Tested compromised IAM user permissions using DryRun flags and placeholder IDs to evaluate EC2 compute, EBS volume, and snapshot capabilities.

Tested compromised IAM user permissions using DryRun flags and placeholder IDs to evaluate EC2 compute, EBS volume, and snapshot capabilities.

Over a span of over 500 web requests, ARTEX probes various file names and extensions across various web directories, in a potential attempt to fuzz which URL endpoints the web-server would allow it to access based on HTTP response code (200 or 403).

Over a span of over 500 web requests, ARTEX probes various file names and extensions across various web directories, in a potential attempt to fuzz which URL endpoints the web-server would allow it to access based on HTTP response code (200 or 403).

Establish Foothold

Abused Kudu administrative APIs to execute arbitrary commands and stage custom Python, C#, and malicious PowerShell scripts.

Abused Kudu administrative APIs to execute arbitrary commands and stage custom Python, C#, and malicious PowerShell scripts.

Established command and control (C2) and execution on the victim's internal Windows database server by using native curl to pull down dynamically generated PowerShell and batch scripts and post back command results across 491 rotating webhook.site URLs.

Established command and control (C2) and execution on the victim's internal Windows database server by using native curl to pull down dynamically generated PowerShell and batch scripts and post back command results across 491 rotating webhook.site URLs.

Escalate Privileges

Attempted to escalate privileges by launching cloud compute instances with potentially high-value IAM roles with the intention of fetching the role’s temporary credentials and thereby escalating privileges in doing so. These attempts however seemed to have failed due to invalid instance profile ARNs.

Attempted to escalate privileges by launching cloud compute instances with potentially high-value IAM roles with the intention of fetching the role’s temporary credentials and thereby escalating privileges in doing so. These attempts however seemed to have failed due to invalid instance profile ARNs.

Escalated privileges by running Kerberoasting scripts to harvest service tickets across compromised domains; using SQL injection to dump database credentials; and, following an offline cracking pause, executing DCSync scripts to steal the domain krbtgt key, cloud AD-sync credentials, and domain Controller machine hashes.

Escalated privileges by running Kerberoasting scripts to harvest service tickets across compromised domains; using SQL injection to dump database credentials; and, following an offline cracking pause, executing DCSync scripts to steal the domain krbtgt key, cloud AD-sync credentials, and domain Controller machine hashes.

Created accounts with is_admin=true within minutes, identifying and utilizing a writable admin flag.

Created accounts with is_admin=true within minutes, identifying and utilizing a writable admin flag.

Internal Recon

Performed reconnaissance across the internal network by running several iterative generated PowerShell enumeration scripts against a Domain Controller and federation server. The scripts validated domain usernames without pre-authentication, listed Group Managed Service Accounts, audited Active Directory Certificate Services templates (SmartcardUser, ClientAuth), mapped thousands of cross-forest security principals, and swept internal Exchange, PasswordState credential vault, and SSRF/SCM targets.

Performed reconnaissance across the internal network by running several iterative generated PowerShell enumeration scripts against a Domain Controller and federation server. The scripts validated domain usernames without pre-authentication, listed Group Managed Service Accounts, audited Active Directory Certificate Services templates (SmartcardUser, ClientAuth), mapped thousands of cross-forest security principals, and swept internal Exchange, PasswordState credential vault, and SSRF/SCM targets.

Move Laterally

Attempted Lateral Movement onto domain controllers using Pass-the-Ticket, WinRM, Kerberos relay, and Pass-the-Hash scripts, hitting local Windows service token privilege restrictions right before endpoint protection blocked execution and defenders severed access to the server.

Attempted Lateral Movement onto domain controllers using Pass-the-Ticket, WinRM, Kerberos relay, and Pass-the-Hash scripts, hitting local Windows service token privilege restrictions right before endpoint protection blocked execution and defenders severed access to the server.

Maintain Presence

Generated a new SSH key pair, allocated a dedicated public Elastic IP, attempted to create a custom security group but failed due to permission issues, and launched persistent t3.micro instances bound to existing security groups to establish an externally addressable jump host and internal foothold.

Generated a new SSH key pair, allocated a dedicated public Elastic IP, attempted to create a custom security group but failed due to permission issues, and launched persistent t3.micro instances bound to existing security groups to establish an externally addressable jump host and internal foothold.

Gained persistence through account takeover (e.g., resetting passwords for identified users), creating multiple accounts with plaintext passwords (which included ArtexProbe in the naming convention), and creating administrator accounts.

Gained persistence through account takeover (e.g., resetting passwords for identified users), creating multiple accounts with plaintext passwords (which included ArtexProbe in the naming convention), and creating administrator accounts.

Complete Mission

Interrogating backend SQL databases (extracting ~400 KB of query results across ~20 queries) and performing mass blob reads.

Interrogating backend SQL databases (extracting ~400 KB of query results across ~20 queries) and performing mass blob reads.

Deployed custom boot scripts via ephemeral, keyless EC2 instances to potentially harvest data from multiple mounted EBS snapshots and volumes.

Deployed custom boot scripts via ephemeral, keyless EC2 instances to potentially harvest data from multiple mounted EBS snapshots and volumes.

Enumerated over 110,000 Active Directory objects from a domain controller and retrieved the Domain Admins group. It then sent command output to rotating webhook.site endpoints via curl.

Enumerated over 110,000 Active Directory objects from a domain controller and retrieved the Domain Admins group. It then sent command output to rotating webhook.site endpoints via curl.

Ran queries to decrypt stored notes and attempted to read other users' note attachments.

Ran queries to decrypt stored notes and attempted to read other users' note attachments.

Created a new 100GB volume and expanded the root disk of launched instances to 60GB, performing preparatory steps likely intended for exfiltration via their automated collection scripts.

Created a new 100GB volume and expanded the root disk of launched instances to 60GB, performing preparatory steps likely intended for exfiltration via their automated collection scripts.

Edited an employee's record in a legacy database, created and deleted notes and status rows, pointed checklist responses at its own probe file. In this case we observed an interesting abuse of legitimate features. Rather than executing complex malware, ARTEX weaponized built-in application features. It forced an application's notification system to broadcast test emails to over 1,300 internal users, turning a trusted notification channel into a mass-internal messaging tool. It then dropped to single-recipient test emails rather than the mass emailing.

Edited an employee's record in a legacy database, created and deleted notes and status rows, pointed checklist responses at its own probe file. In this case we observed an interesting abuse of legitimate features. Rather than executing complex malware, ARTEX weaponized built-in application features. It forced an application's notification system to broadcast test emails to over 1,300 internal users, turning a trusted notification channel into a mass-internal messaging tool. It then dropped to single-recipient test emails rather than the mass emailing.

PentAGI Offensive Framework

GTIG also observed in the wild abuse of PentAGI (Penetration Testing Artificial General Intelligence), an autonomous offensive framework designed to automate the pentesting process within an isolated environment. Developed by VXControl, the framework is offered in an open source and commercial edition. It is designed so that the user only needs to describe a target and a goal, which enables entry-level users to run complex cyber security campaigns. Once the target and the goal have been selected, the framework uses a team of specialized agents, each with their own functionalities to break tasks (called “Flows”) into various sub-tasks, execute each step, and report on it. The tools and commands are all run in isolated sandboxes running Kali Linux instead of in the host environment. All the tools used by PentAGI are open-source pentesting tools available by default in Kali Linux (e.g., metasploit, nmap, SQLmap). The framework supports over a dozen cloud and local LLM backends, including frontier and open weight models.

The majority of observed PentAGI activity remained at the stage of WHOIS asset mapping or active vulnerability scanning. However, analysis of operational artifacts indicates that some operations progressed to active intrusions and persistence across multiple organizations. Operators are also adapting and integrating the framework in different ways. In one case, we identified a customized attack orchestration platform built on the open-source version of PentAGI likely used between at least late August and early October 2026 to conduct systematic reconnaissance and vulnerability scanning against a wide range of organizations in Asia, including system integrators and major telecommunications firms. In another instance, we observed PentAGI chained with proxy services to target the Aerospace sector.