1-minute read
What a defender needs to know
Google Threat Intelligence Group and Mandiant observed attackers using ARTEX and other agentic offensive frameworks in intrusions since late August 2026. In one ARTEX sequence, the researchers counted 27 AWS-permission events in 23 seconds. Attackers supplied compromised credentials in several cases and the software rapidly tested what those identities could reach. A separate application-specific API attempt produced 240 log events as the framework tried different paths to execution. Both counts describe activity in investigated incidents, not a number of affected organizations.
For cloud and App Service defenders, tie sign-ins and permission-test bursts to the identity, request origin, target resource, errors and the next successful action. Search relevant web and database logs for artex-probe-, ArtexProbe, the observed .jsp candidates cl1217.jsp, f1219a.jsp and z1219.jsp, and changes to MySQL settings general_log_file and general_log. The same research also describes abuse of Kudu administration and an application notification feature that sent test emails to more than 1,300 internal users. Investigate the application notification trail where that feature was accessible.
Restrict App Service SCM/Kudu access through its separate access rules or an appropriately restricted main-site rule set; Microsoft documents both configurations. Allow only deployment or approved administration paths, and test that an unapproved public request is denied while deployment still succeeds. Shorten and scope workload credentials and review earlier identity and host events for access already obtained. The defensive advantage is reducing the actions a stolen identity can perform during a seconds-long burst.