A financially motivated threat group has used the Artex pen-testing framework in attacks against banking and other industry firms in Southeast Asia and across the globe, according to a report Friday by Microsoft Threat Intelligence.
The Cambodia-based actor, tracked as Storm 3358, began the attacks in October using a combination of Artex along with conventional tools, according to researchers. The hackers exploited server-side request forgery and anonymous file-upload flaws before installing remote-access Trojans.
The campaign marked the latest in a growing wave of attacks using Artex, an AI-enabled pen-testing tool that allows hackers to automate attacks well beyond human capabilities.
In recent months, hackers have used Artex against South Korean banks, dozens of Japanese companies and abuse of ConnectWise Cloud Backup against Microsoft 365 tenants, linked to a China-based actor tracked as Storm-0940.
CrowdStrike linked threat activity from an actor it tracks as Vapor Panda to a global espionage campaign using Artex against 200 organizations across the globe.
The Indian Computer Emergency Response Team last week reported a campaign using Artex and other AI-enabled tooling against a range of fintechs, digital lenders and non-banking financial companies.
Indian officials said a threat actor tracked as Crafty Falcon has used Artex and other AI-based tools like Cairn and the PentAGI pen testing framework.
Microsoft researchers on Thursday reported hackers using Artex to scan GitHub for exposed credentials.
Observed tactics
The Cambodia-based actor has used vshell and AdaptixC2 remote-access Trojans to gain persistence and enable lateral movement, according to researchers. Hackers have also used utilities such as curl and netcat to download the remote-access Trojans onto compromised systems.
Researchers said that setting up defensive honeypots or decoys can sometimes divert autonomous AI attackers away from legitimate targets. They often convince the agent that a successful attack has been completed and drain time and financial resources from the attacker.
