Executive Summary
Google Threat Intelligence Group, Microsoft and Wiz report intrusions that used agentic offensive frameworks, most of all the open source ARTEX platform. An attacker gives a multi agent system a goal and credentials and its agents generate and run the commands. Google tracks the activity as UNC7228, which overlaps Storm-0940 in Microsoft reporting. Google reports activity since at least August 2026 against enterprise software, industrial automation, semiconductor and telecom targets in the US and Europe.
In the intrusions Google describes, generated PowerShell enumerated Active Directory, requested service tickets for Kerberoasting and took the krbtgt key through DCSync after an offline cracking pause. The agents also tried Pass the Ticket, WinRM, Kerberos relay and Pass the Hash, which were blocked. Execution bursts lasted 2 to 25 seconds. Time to deep access was about 4 hours and in one case 15 minutes.
Google publishes no IP addresses or hashes, so detection depends on behavior: curl posts to webhook[.]site, artex-probe-* files, ArtexProbe accounts, JSP files written through MySQL log poisoning and bursts of Kerberos and directory replication events.
Key Details
Threat Name
ARTEX Framework
Affects
—
Adversary
UNC7228 Other Adversaries and Aliases: Storm-0940
MITRE Techniques
Malware/Tools
ARTEX, PentAGI, Hexstrike, CAIRN, Impacket, Aur0ra, HONESTCUE, PROMPTSPY, AgentZero