International
The Morning Dev

Only the news worth knowing

‹
 
S89/100

Incident · high

ARTEX agentic attack campaign

Tier S · Shit hits the fan – Drop everything

Who’s exposed: AWS environments exposed to compromised keys or public Cognito pools

Tier S because: Core infrastructure AND exploited in the wild AND (full takeover OR secrets exposed)

Reach

Attack

Damage

Fix

Core infrastructure · Popular tool · Exploited in the wild · Secrets exposed

The Brief

  • Datadog Security Labs reports in-the-wild activity from ARTEX, an AI-native penetration framework, targeting AWS environments.
  • The campaign includes CloudWatch log hunting using compromised access keys.
  • Attackers also abuse public Amazon Cognito user pools.

Why it matters

Developers running AWS workloads should assume automated, agent-driven attacks can search logs for leaked credentials and probe identity services such as Cognito.

The checklist behind the tier

Checklist · 5 of 10 yes
YesHits tech teamsJudgment: AWS cloud environments are run and built on by developers and ops teams.
YesCore infrastructureJudgment: AWS is a major cloud platform that nearly every team depends on.
YesPopular toolJudgment: AWS is a widely used platform; coreInfra is yes.
YesExploited in the wildDatadog Security Labs: shares in-the-wild activity from ARTEX against AWS environments.
NoPublic exploitDatadog Security Labs: describes campaign activity; no source says exploit code or PoC is published.
NoRemote, no loginDatadog Security Labs: does not state that unauthenticated network access is sufficient.
NoFull takeoverDatadog Security Labs: no source says code execution, root or admin takeover occurred.
YesSecrets exposedDatadog Security Labs: describes CloudWatch log hunting with compromised access keys.
NoSupply chainDatadog Security Labs: no source reports a compromised package, update, pipeline or signing key.
NoNo fix yetDatadog Security Labs: describes an attack campaign, not a vulnerability awaiting a patch.

Timeline

  1. The Hacker News

    CERT-In Flags AI-Driven Attacks as Backdoored ARTEX Exposes 62 Consoles to Root Access

  2. BleepingComputer

    Hackers backdoor Linux servers using trojanized CWP web server

  3. The Hacker News

    Hackers Hide Linux Backdoor in Control Web Panel Server to Execute Commands Without Logs

  4. AI News & Artificial Intelligence | TechCrunch

    Hundreds of Artex AI hacking tools found publicly exposed to the web

  5. Microsoft Security Blog

    ARTEX abuse expands as cybercriminals target financial sector

  6. Security Affairs

    Inside ARTEX: AI Hacking Tools, Exposed Servers and South Korean Bank Breaches

  7. Datadog Security Labs publishes analysis of ARTEX activity against AWS environments

  8. Datadog Security Labs

    On the hunt for ARTEX: understanding agentic attacks in AWS environments

  9. Step Security Blog

    ARTEX: Attackers Adopted This AI Pentesting Tool in Three Months. Leaked Secrets Are Its Fastest Way In.

  10. Cloudflare Blog

    Adapting to AI penetration testing orchestrators: The Modern Security Model

  11. Cisco Talos Blog

    ARTEX and beyond: AI-enabled penetration testing platforms

  12. The Record from Recorded Future News

    FBI flash alert says Artex tool automating cyberattacks at ‘machine speed’

Full coverage · 11 sources

First seen · 11 sources · Full story page · How tiers are decided