> ## Content Index
> Fetch the complete content index at: https://f4n6.co.uk/llms.txt
> Use this file to discover other available public pages before exploring further.

# UNC7228 uses ARTEX agentic framework for rapid EMEA intrusions
- URL: https://f4n6.co.uk/security-feed/unc7228-uses-artex-agentic-framework-for-rapid-emea-intrusions/
- Published: 2026-11-01T21:30:51.000Z
- Updated: 2026-11-01T21:30:51.000Z
- Author: Jeff Davies
- Tags: #security-feed, UNC7228, STORM-0940

## 1\. Executive summary

Google Threat Intelligence Group (GTIG) and Mandiant report that since late August 2026 multiple threat actors have used the open-source, LLM-driven multi-agent pentesting framework ARTEX, and the related frameworks PentAGI and CAIRN, inside incident response engagements, with agentic tooling conducting lateral movement, database exploitation and exfiltration preparation. One cluster, tracked by GTIG as UNC7228 and reported by Wiz to overlap with the activity Microsoft tracks as STORM-0940, moved from a first compromised account to deep system access in around four hours, and in one case in 15 minutes, against victims in the US and Europe across enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications. Neither UNC7228 nor STORM-0940 has a MITRE ATT&CK profile, so the PRC-nexus attribution is unconfirmed. No CVE is named in the reporting and no victim in the financial sector is identified; public reporting cited by GTIG places separate ARTEX targeting against the financial sector in Asia. The risk to EMEA financial services is not a new exploit but the compression of credential-based intrusion timelines, which shortens the window in which identity, control-plane and data-plane telemetry can catch an intrusion before data access.

## 2\. Regulatory framing

| Article                                                                     | Trigger (the fact in this item)                                                                                                                                          | Practical impact                                                                                                                                                                                                             |
| --------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| DORA Art. 17: ICT-related incident management process                       | ARTEX sequences run in bursts of roughly 2 to 25 seconds, with 27 events in 23 seconds in one operation, and one intrusion reached deep system access in 15 minutes      | Detection and escalation procedures built around human-paced intrusion timelines will not fire in time; the incident management process needs automated sequence detection and a defined fast path from alert to containment |
| DORA Art. 24: digital operational resilience testing — general requirements | The framework was built as a pentesting platform and its operators reached database command execution through exposed application API calls and MySQL general\_log abuse | Resilience testing should exercise the paths ARTEX used: exposed application APIs, database runtime privileges and the database-to-OS boundary, not only perimeter controls                                                  |

## 3\. Technical analysis & attack chain

ARTEX is an autonomous, multi-agent LLM-driven pentesting and offensive command-and-control platform written in Go with an embedded Next.js web console. It was developed by the GitHub user Autumn-27; the original repository was taken down by its creator in October 2026 because of threat actor abuse, and the framework continues to circulate through community forks, including a localized variant named ScopeWeaver and a commercial version called ARTEX PRO. It abstracts the attack lifecycle across six specialized sub-agents and calls APIs from frontier and open source models to turn high-level tactical goals into machine commands. GTIG observed automated Active Directory reconnaissance, privilege escalation, target cloud-infrastructure profiling including harvesting Azure storage keys, and the synthesis and deployment of custom webshells.

The confirmed sequence in the intrusions GTIG and Mandiant describe:

1. Adversaries supplied ARTEX with compromised credentials for the target organization and instructed it to execute later stages of the attack lifecycle.
2. ARTEX performed reconnaissance and access probing. In one case it generated files of various extension types named `artex-probe-*`, where the asterisk carried five-digit, somewhat-incremental numbers. The source does not explain how the numbers increment.
3. Against an external-facing Linux Weaver OA web server, ARTEX used legitimately exposed application-specific API calls to execute SQL commands, achieving partial command execution for further reconnaissance. The process generated 240 log events and showed errors the source attributes to multiple sub-agents overwriting one another while pursuing the same objective.
4. To move from a database-execution context to a system-execution context, ARTEX used an application-specific SQL API available to the supplied user credential to make the MySQL instance write log files with a `.jsp` extension to publicly accessible locations. It ran `SET GLOBAL general_log_file = '<path to webshell>'` followed by `SET GLOBAL general_log = 1;`, after which subsequent SQL commands were written to the file named in `general_log_file`. ARTEX then ran `SELECT` statements of the form `SELECT '<% [webshell content] %>'`. The Java web servlet parses and compiles the code inside `<% %>` into process memory, giving execution.
5. The log activity shows repeated iterations with incremental file names (`cl1217.jsp`, `f1219a.jsp`, `z1219.jsp`), each webshell candidate executing a different command. Errors such as `variable 't is already defined` caused webshells to fail, and ARTEX refactored, writing several unique webshells with different goals until they executed cleanly and returned valid command output.
6. In cloud infrastructure, ARTEX rapidly probed AWS permissions across security groups, and while preparing exfiltration scripts it adapted to a "script too large" error by trimming the script and relaunching it, deploying a 17-snapshot instance in approximately 10 seconds.

The forensic signature is timing. Individual ARTEX execution sequences ran in compressed bursts of roughly 2 to 25 seconds, with extended pauses between operational phases, and in at least one operation 27 events occurred in 23 seconds of active burst time. The source describes the tradecraft as far noisier than a competent human operator, relying on rapid iterative trial and error, and notes ARTEX used similar incremental numeric markers in dropped file names, created account names, their passwords and email subjects.

UNC7228 moved from first compromised account to deep system access in around four hours, and in one case as rapidly as 15 minutes. The actor customized tooling to victim-specific setups and fell back to open proxies when its initial infrastructure was blocked. Wiz identified targeting, compromise and data theft at multiple entities in the US and Europe in enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications. GTIG also observed financially motivated actors using ARTEX for data theft extortion and additional suspected PRC-nexus clusters, impacting government, technology, chemicals and materials, and manufacturing organizations in the US, alongside public reporting of ARTEX targeting the financial sector in Asia.

PentAGI, developed by VXControl and offered in open source and commercial editions, runs its tools in isolated Kali Linux sandboxes using default Kali tooling such as metasploit, nmap and SQLmap, and supports over a dozen cloud and local LLM backends. Most observed PentAGI activity stayed at WHOIS asset mapping or active vulnerability scanning, but operational artifacts show some operations progressed to active intrusions and persistence across multiple organizations. One customized orchestration platform built on the open-source PentAGI was likely used between at least late August and early October 2026 for systematic reconnaissance and vulnerability scanning against organizations in Asia, including system integrators and major telecommunications firms; in another instance PentAGI was chained with proxy services against the Aerospace sector.

Attribution caveats. The overlap between UNC7228 and STORM-0940 is reported by Wiz and relayed by GTIG; the PRC-nexus label for STORM-0940 is Microsoft's. Neither actor has a MITRE ATT&CK profile, and Adverse Trace treats both attributions as unconfirmed. No CVE is named anywhere in the reporting, so no vulnerability severity, exploitation state or fixed version can be attached to this activity. The victim counts, the four-hour and 15-minute timelines and the industry list rest on the Wiz research as relayed by GTIG; treat them as single-sourced until Wiz's own report is reviewed.

## 4\. Mitigation & containment

P1, within 24 hours:

- Restrict administrative interfaces that ARTEX reached or tested to trusted networks: application publishing and management endpoints (for Azure App Service, the Kudu Site Control Manager, or SCM, endpoint, configured separately), cloud management APIs, firewall and virtualization consoles, backup platforms and CI/CD interfaces. Disable basic publishing authentication on SCM where it is not required.
- Remove broad privileges from application database accounts. Accounts reachable from an internet-facing application should not be able to run `SET GLOBAL` or write arbitrary files. Where MySQL `general_log` is not required, leave `general_log = 0`, and alert on any change to `general_log` or `general_log_file`.
- Hunt for `.jsp` files written to web-accessible directories by database processes, and for the file-name pattern `artex-probe-` followed by five digits, in web roots, upload directories and temporary paths.
- Replace static cloud credentials that grant broad access with short-lived, workload-bound credentials: AWS IAM roles instead of long-lived access keys, Azure Managed Identities instead of service principal client secrets, and disallow Azure Storage shared key authentication in favour of Entra ID authorization with Conditional Access. Restrict `iam:PassRole` to specific roles and services, with conditions such as `iam:PassedToService` where appropriate.

P2, within 72 hours:

- Baseline and alert on control-plane velocity: bursts of management API calls, permission enumeration, credential retrieval and configuration changes from a single identity in seconds. The ARTEX burst profile (2 to 25 seconds, 27 events in 23 seconds) is the pattern to test against.
- Restrict egress from production servers and alert on previously unseen destinations, particularly webhook services, OAST infrastructure, tunnelling platforms, public file-transfer services and external AI platforms the workload does not require.
- Enable Windows Credential Guard where appropriate, use Protected Users for suitable privileged accounts, and enforce SMB signing and LDAP signing and channel binding to reduce credential replay and relay.
- Review AD CS for templates that allow an attacker to obtain authentication certificates; remove `ENROLLEE_SUPPLIES_SUBJECT` where it is not required, particularly on client-authentication templates, and restrict enrollment permissions.

P3, within 7 days:

- Put rate limits, recipient limits and transaction thresholds on high-impact business APIs (email and notification sending, user creation, access modification) and alert when an application operates outside its normal volume.
- Segment internet-facing applications from identity infrastructure and management systems, and restrict DMZ workloads from initiating Kerberos, NTLM, LDAP, SMB, RDP, SSH, database and administrative connections into internal networks.
- Scan repositories, container images, build artifacts and pipelines for exposed secrets, and rotate any exposed credential rather than relying on removal from source-control history.

No fixed release or patch closes this activity: the framework abuses credentials and supported functionality, and no CVE is named in public reporting.

## 5\. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses) are given in the reporting. The observable artefacts are file names and command strings, listed as behavioural indicators.

| type | value                          | confidence | source |
| ---- | ------------------------------ | ---------- | ------ |
| n/a  | No atomic indicators available | n/a        | n/a    |

Behavioural indicators

| behaviour                                                                                                               | where to observe                                                              | confidence                            |
| ----------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------- | ------------------------------------- |
| Files named artex-probe- followed by five digits, of various extension types                                            | File creation telemetry on probed hosts and web roots                         | Medium; single source (GTIG/Mandiant) |
| MySQL general\_log\_file set to a path with a .jsp extension, then general\_log enabled                                 | MySQL general query log, database audit logs, configuration change monitoring | Medium; single source                 |
| SELECT statements whose payload is <% ... %> JSP content written into the query log                                     | Database query logs, WAF and API gateway request bodies                       | Medium; single source                 |
| Webshell files with incremental names such as cl1217.jsp, f1219a.jsp, z1219.jsp appearing in web-accessible directories | Web server file integrity monitoring, web root change alerts                  | Medium; single source                 |
| Bursts of 27 or more events in roughly 20 to 25 seconds from one identity, followed by extended pauses                  | SIEM correlation across identity, control-plane and data-plane logs           | Medium; single source                 |
| Rapid AWS permission probing across security groups from a single credential                                            | AWS CloudTrail, GetCallerIdentity and IAM API call volume                     | Medium; single source                 |
| Creation of a 17-snapshot instance shortly after a "script too large" error and script retry                            | Cloud API logs for snapshot and instance creation                             | Low; single incident described        |

## 6\. Detection

```yara
rule ARTEX_JSP_Webshell_Log_Poisoning
{
    meta:
        author = "Adverse Trace"
        date = "2026-11-01"
        reference = "https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/"
        description = "Detects JSP webshell content written via MySQL general_log poisoning, as described in ARTEX intrusions"
    strings:
        $jsp_open = "<%"
        $jsp_close = "%>"
        $log_file = "general_log_file"
        $log_on = "general_log = 1"
    condition:
        filesize < 1MB and $jsp_open and $jsp_close and any of ($log_*)
}

```

```yaml
title: ARTEX MySQL General Log Webshell Write and Probe Artefacts
id: 7c1e4b2a-3f6d-4a91-9c2e-artex000001
status: experimental
description: Detects MySQL general_log redirection to a JSP path and artex-probe file creation consistent with ARTEX activity
author: Adverse Trace
date: 2026/11/01
references:

    - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/
logsource:
    product: mysql
    category: audit
detection:
    selection_log_redirect:
        query|contains:

            - "SET GLOBAL general_log_file"
            - "SET GLOBAL general_log = 1"
    selection_jsp_path:
        query|contains: ".jsp"
    condition: selection_log_redirect and selection_jsp_path
falsepositives:

    - Legitimate administrative changes to MySQL logging where JSP is not involved
level: high

```

```yaml
title: ARTEX Probe File Creation
id: 9d2f5c3b-4a7e-4b02-8d1f-artex000002
status: experimental
description: Detects creation of files named artex-probe- followed by five digits
author: Adverse Trace
date: 2026/11/01
references:

    - https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/
logsource:
    category: file_event
detection:
    selection:
        TargetFilename|re: 'artex-probe-[0-9]{5}'
    condition: selection
falsepositives:

    - Unknown; the string is specific to ARTEX probing
level: high

```

## 7\. Sources

- Google Threat Intelligence Group / Mandiant, "ARTEX and Friends: Enter Agentic Offensive Frameworks", https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/, 2026-10-30

## 8\. Adverse Trace position

Adverse Trace assesses the risk to EMEA financial services clients as elevated but not yet direct: no source names a financial-sector victim in Europe, the PRC-nexus attribution for UNC7228 and STORM-0940 is unconfirmed and neither actor has a MITRE ATT&CK profile, and no CVE or exploitation state applies. The material change is speed. Credential-based intrusions that reached deep access in four hours, and once in 15 minutes, defeat escalation paths tuned to human operators, and the ARTEX burst pattern gives defenders a timing signature to hunt on. The victim and timeline detail rests on Wiz research as relayed by GTIG and is single-sourced; verify it against Wiz's own report before relying on the industry list. We will monitor for ARTEX, PentAGI and CAIRN artefacts in client telemetry, prioritise the database logging and control-plane exposure checks in section 4, and reissue this advisory if a financial-sector victim or a named CVE is confirmed.

---

[Read the original source →](https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks/?ref=f4n6.co.uk)

*Published via PulseTrace — Adverse Trace threat intelligence.*