Security · High impactFan score 66 · Tier A
On the hunt for ARTEX: understanding agentic attacks in AWS environments
The Brief
- Datadog Security Labs reports in-the-wild activity from ARTEX, an AI-native penetration framework, against AWS environments.
- The observed activity includes CloudWatch log hunting using compromised access keys.
- The activity also includes abuse of public Cognito user pools.
Why it matters
Teams running workloads on AWS should check whether access keys are exposed and whether CloudWatch logs and Cognito user pools are configured in ways this activity exploits.
Who’s affected
- Teams running workloads in AWS
- Teams using Amazon Cognito user pools
- #security
- #aws
- #penetration-testing
- #cloudwatch
- #cognito
- #ai-attacks
We share in-the-wild activity from ARTEX, an AI-native penetration framework, against AWS environments, including CloudWatch log hunting with compromised access keys and abuse of public Cognito user pools.
Timeline
Datadog Security Labs published its report on ARTEX agentic attacks in AWS environments
Datadog Security Labs
On the hunt for ARTEX: understanding agentic attacks in AWS environments