International
The Morning Dev

Only the news worth knowing

‹
 
A66/100

Incident · high

Datadog reports ARTEX agentic attacks in AWS environments

Tier A · Patch today – Before you go home

Who’s exposed: AWS environments with compromised access keys or public Cognito user pools

Tier A because: Core infrastructure or popular tool AND exploited in the wild

Reach

Attack

Damage

Fix

Popular tool · Exploited in the wild · Secrets exposed

The Brief

  • Datadog Security Labs reports in-the-wild activity from ARTEX, an AI-native penetration framework, against AWS environments.
  • The observed activity includes CloudWatch log hunting using compromised access keys.
  • The activity also includes abuse of public Cognito user pools.

Why it matters

Teams running workloads on AWS should check whether access keys are exposed and whether CloudWatch logs and Cognito user pools are configured in ways this activity exploits.

The checklist behind the tier

Checklist · 4 of 10 yes
YesHits tech teamsAWS cloud environments are run and managed by developers and ops teams.
NoCore infrastructureThe incident is attacker activity against customer AWS accounts, not a flaw in or compromise of AWS software itself.
YesPopular toolAWS is a widely used cloud platform, and the attacks target AWS environments.
YesExploited in the wildDatadog Security Labs: shares in-the-wild activity from ARTEX against AWS environments.
NoPublic exploitDatadog Security Labs describes observed activity; no source says exploit code or a PoC is published.
NoRemote, no loginDatadog Security Labs: no source states the attacks need no credentials; compromised access keys are used.
NoFull takeoverDatadog Security Labs does not report code execution, root/admin rights or full account takeover.
YesSecrets exposedDatadog Security Labs: attacks involve compromised access keys used for CloudWatch log hunting.
NoSupply chainDatadog Security Labs reports no compromised packages, updates, build pipelines or signing keys.
NoNo fix yetDatadog Security Labs does not state whether a fix or patch exists.

Timeline

  1. Datadog Security Labs published its report on ARTEX agentic attacks in AWS environments

  2. Datadog Security Labs

    On the hunt for ARTEX: understanding agentic attacks in AWS environments

Source

On the hunt for ARTEX: understanding agentic attacks in AWS environments ↗ Datadog Security Labs · 20h ago

First seen · 1 source · Full story page · How tiers are decided