Cases › security breach › LR-2026-0824

ARTEX multi-agent framework used by attackers to automate Active Directory compromise

Preliminary Why: 1 report: Cyber Security News · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

No source states: loss or records, developer and model, deployer, industry.

Severity major: a live production compromise across multiple victim organizations in several sectors, with domain controller hashes and the krbtgt key taken.

Attackers used ARTEX, an open-source multi-agent penetration-testing and command-and-control platform written in Go, to automate network break-ins. The attacker supplied a goal and stolen credentials, and the framework split the work across six sub-agents that ran PowerShell against domain controllers and federation servers, enumerated managed service accounts and AD CS templates, pulled more than 110,000 Active Directory objects, performed Kerberoasting, and ran DCSync to take the krbtgt key, cloud sync credentials and domain controller hashes. It then attempted lateral movement via Pass-the-Ticket, WinRM, Kerberos relay and Pass-the-Hash; Windows service token limits and endpoint protection blocked some attempts before defenders cut off the server. Google Threat Intelligence Group and Mandiant identified the activity during incident response, seeing use since late August 2026 against government, technology, chemicals, manufacturing and telecommunications organizations.source

LR-2026-0824 · version 1 · published 2026-11-03 after automatic checks; not yet checked field by field by a person · JSON