Observed since late August. Includes profit-driven actors conducting data-theft extortion. Webshells were dropped by writing to logs, and results were sent back through 491 rotating webhook.site URLs.
Confirmed victims
- US government, technology, chemicals and materials, and manufacturing organizations (not named)
Attribution
- ARTEX basis
- GTIG relied on incident response forensics and recorded tool traces such as artex-probe-*.
- Actor
- financially motivated threat actors; additional suspected PRC-nexus clusters.
- Same attacker?
- Multiple actors. ARTEX does not equal one attacker.
Figures and definitions
| Speed | One operation: 27 events in 23 seconds; individual commands compressed to about 2 to 25 seconds |
|---|---|
| Scale | One operation enumerated more than 110,000 AD objects and 1,300+ internal users |
Related events
Sources (1)
- 2026-10-31 Vendor Google Threat Intelligence Group / Mandiant ARTEX and Friends: Enter Agentic Offensive Frameworks