Hackers Use ARTEX AI to Automate Enterprise Attacks at Machine Speed – Insights for Defenders

AI-powered offensive frameworks are helping attackers move from stolen credentials to cloud privilege escalation, lateral movement, and data theft in minutes. Recent ARTEX campaigns show why organizations must rethink how they detect and stop automated intrusions. Cybercriminals and state-linked hacking groups are increasingly using an artificial intelligence-powered framework called ARTEX to automate complex attacks against enterprise networks, cloud platforms, and identity systems. Unlike traditional attack tools that require operators to manually select and execute each step, ARTEX uses multiple AI agents to investigate targets, run security tools, interpret results, and determine what to do next. The framework has already appeared in real-world intrusions involving government agencies, financial institutions, technology companies, and critical industries. Research published by Google Threat Intelligence Group and Mandiant on October 30, 2026, identified ARTEX being used for Active Directory attacks, privilege escalation, cloud infrastructure reconnaissance, lateral movement, and preparation for data exfiltration. Microsoft separately linked ARTEX to Storm-0940, a China-state-aligned threat actor that used the framework to accelerate attacks involving compromised ConnectWise application credentials and Microsoft 365 environments. In another campaign, CrowdStrike identified the China-nexus group VAPOR PANDA using ARTEX to target more than 200 organizations worldwide. These investigations show a significant change in offensive operations.…