GTIG: agent pentest frameworks ran intrusion steps in 2 to 25 seconds

01What happened

Google Threat Intelligence Group and Mandiant published ARTEX and Friends on October 30, 2026, describing threat actors operating open-source agentic pentest frameworks inside Mandiant incident response engagements since late August 2026. GTIG tracks the main ARTEX campaign as UNC7228, which it says overlaps with the PRC-nexus actor Microsoft calls STORM-0940. ARTEX's original author, a GitHub user known as Autumn-27, removed the repository in October 2026, but forks including ScopeWeaver and a commercial ARTEX PRO keep circulating.

02How it works

ARTEX splits the attack lifecycle across six specialized sub-agents that turn a high-level goal into machine commands through frontier and open-source model APIs. The pace shows up in the logs: 27 events in 23 seconds while probing AWS permissions, an 8-second Azure deployment validation sweep across 11 resource types, and enumeration of more than 110,000 Active Directory objects, with results posted out to 491 rotating webhook.site URLs. GTIG writes that the frameworks compress attack timelines to machine speed but currently trade stealth for velocity, leaving 240 log events on one web server and probe files named with five-digit counters.

03Who is affected

Cloud and identity estates are the ground these frameworks cover: AWS, Azure, Active Directory, AD CS and Kudu administrative APIs all appear in GTIG's cases. Wiz identified UNC7228 targeting and data theft in the United States and Europe across enterprise software, industrial automation, semiconductor manufacturing and design, and telecommunications. GTIG says the cluster usually reached deep system access about four hours after the first compromised account, and in one case in 15 minutes.

04What to do

Work through the five layers Mandiant sets out: restrict administrative control planes to managed devices with phishing-resistant MFA, replace static cloud keys with short-lived workload credentials, segment application tiers from identity systems, rate-limit high-impact APIs such as bulk messaging and user creation, and alert on identity velocity rather than on single actions. Baseline known-good automation first, then watch server egress to webhook services and to external AI platforms the workload does not need.

Questions people ask

Is fully autonomous hacking happening yet?

Google Threat Intelligence Group places the current state at stage 5 of its seven-stage maturity scale: language models driving individual lifecycle stages in the wild. GTIG expects stage 6, multi-agent operations with little human interaction, within one to three months, and stage 7, sophisticated fully autonomous intrusions using self-hosted or obscured models, within three to six months.

Does ARTEX make an intrusion harder to spot?

ARTEX is noisier than a human operator, according to the GTIG and Mandiant report, which says these frameworks compress attack timelines to machine speed but trade stealth for velocity. One ARTEX run generated 240 log events against a single Weaver OA web server, sub-agents overwrote one another's work, and access probing left files named artex-probe with five-digit incremental counters.

How is UNC7228 related to STORM-0940?

UNC7228 is the name Google Threat Intelligence Group gives the ARTEX campaign that Wiz also tracks, and GTIG says the cluster overlaps with STORM-0940, a PRC-nexus actor named by Microsoft. Activity dates to at least August 2026. Wiz reported targeting and data theft across enterprise software, industrial automation, semiconductor manufacturing and telecommunications in the United States and Europe.

Which detections does Google publish for this activity?

Google SecOps rules in the Mandiant Frontline Threats and Mandiant Hunting Rules packs cover the activity, including Suspicious Webhook.Site Interaction, Suspicious Curl Invocation, Cmd Launching Curl, and AWS Cloud Accounts Getcalleridentity. GTIG warns that rules overlapping legitimate automation depend on identity, origin, volume and sequence rather than the action itself, so teams should baseline known-good automation first.

Sources 3 links, all fetched

1. 1cloud.google.comGTIG Report
2. 2cloud.google.comPrompting To Autonomy
3. 3microsoft.comMicrosoft On Storm-0940