AGENTIC OFFENSIVE FRAMEWORKS HIT REAL INTRUSIONS

Summary from the TLDR InfoSec newsletter

Google Threat Intelligence Group (GTIG) and Mandiant observed intruders using the open-source ARTEX framework with stolen credentials and letting its six sub-agents run Azure and AWS permission sweeps, Kerberoasting, DCSync, and MySQL log poisoning that wrote JSP webshells in bursts as short as 2 to 25 seconds. ARTEX users included financially motivated extortion groups and suspected PRC-nexus clusters such as UNC7228, which went from a first account to deep access in about four hours, though GTIG noted the agents were forensically noisy and sometimes undid each other's work. Mandiant recommended short-lived, tightly scoped credentials, locking down admin interfaces like Kudu/SCM as privileged infrastructure, and behavioral detection tuned for machine-speed bursts.