{"resourceId":"gtig-artex-agentic-offensive-frameworks-in-the-wild-2026","versions":[{"version":"external-97a7400d2b0c7f3b746fea834b310a51abbb1cd90b6f3f2f87d2c3f9b01da2d4","resource":{"id":"gtig-artex-agentic-offensive-frameworks-in-the-wild-2026","title":"Google Threat Intelligence Group and Mandiant: ARTEX and Friends — agentic offensive frameworks observed in incident response","organization":"Google Threat Intelligence Group (GTIG) and Mandiant","sector":"Cybersecurity threat intelligence; incident response across government and private sectors","geography":"Global, with U.S. government-sector victims reported","publishedAt":"2026-10-30","publicationDate":"2026-10-30","eventDate":null,"sourceName":"Google Cloud Blog (Threat Intelligence)","sourceLabel":"Independent threat research from another security vendor","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks","evidenceClass":"independent-research","outcomeClass":"cautionary","topics":["developers-agents","data-security","infrastructure","operating-model"],"finding":"GTIG and Mandiant report that since late August 2026 several threat actors have run ARTEX, PentAGI, CAIRN and custom harnesses during real intrusions they responded to, affecting U.S. government, technology, chemicals and manufacturing organizations. ARTEX ran in bursts of about 2 to 25 seconds (27 events in 23 seconds in one case), but it was 'far more forensically noisy' than a skilled human: one attempt produced 240 log events, and in one case endpoint protection blocked lateral movement. GTIG judges current use early-stage and 'broad and noisy, but still successful'. Why now: this is the first non-CrowdStrike, incident-response view of the ARTEX activity that CrowdStrike's Oct 29 VAPOR PANDA report centers on, while the Oct 31 edition found that every VAPOR PANDA figure rested on CrowdStrike alone.","sledRelevance":"Direct for state and local agencies: GTIG names U.S. government-sector organizations among those affected, without naming the level of government. For the CrowdStrike stream it is an independent check on CrowdStrike's framing: it agrees that ARTEX is used in real intrusions and moves fast, but stresses that the activity is noisy and detectable, which tempers vendor messaging that only machine-speed defense can keep up.","evidence":"Incident-response observations and research telemetry from Google/Mandiant, a CrowdStrike competitor. Independent of CrowdStrike, but not peer reviewed; victims are not named, case counts are not given, and the report does not assess VAPOR PANDA or test any CrowdStrike claim directly.","architectureImplications":"Defenses GTIG recommends are architectural: control-plane isolation, short-lived scoped credentials, least privilege, segmentation of application tiers and behavioral detection based on identity, control-plane, data-plane and network telemetry.","governanceImplications":"Agencies should require incident reports to separate tool presence, execution, success and attribution, and should check where cloud credentials and service principals are long-lived.","securityPrivacyImplications":"Observed activity includes harvesting Azure storage keys, DCSync of domain secrets, mass database reads and abuse of a notification system to email over 1,300 internal users.","caveats":"Vendor research by a CrowdStrike competitor; no victim names, case counts or rate of success. The report does not mention CrowdStrike, so it corroborates the threat class, not CrowdStrike's attribution or figures. Published Oct 30, before the last run, and carried today because it was missed then and remains current.","streamIds":["crowdstrike"],"roles":{"sales":"Balance is the framing point. Google and Mandiant confirm from their own incident response that ARTEX-style agentic tools are being used against U.S. government organizations, which supports CrowdStrike's warning. They also describe the activity as noisy and often detectable. Interpretation: in state or local conversations, present agentic attacks as a real but detectable threat and ask about credential hygiene and telemetry coverage. Do not use this source to argue for any one vendor's product; it names none.","engineering":"Telemetry is the framing point. GTIG shows ARTEX working in short bursts of seconds, producing hundreds of log events, and in one case being stopped by endpoint protection before lateral movement succeeded. Interpretation: pre-sales should check whether a customer collects the identity, cloud control-plane and endpoint data needed to see such bursts, and whether short-lived credentials limit what a stolen key can do. Proof of value should include replaying burst-like activity and confirming alerts fire, not just checking static indicators.","delivery":"Hardening is the framing point. GTIG's five-layer guidance maps to work delivery teams can run for an agency: replace long-lived secrets, restrict control-plane access, segment tiers and tune behavioral detection. Interpretation: the customer's security operations lead owns the outcome, with cloud and identity teams as dependencies. Proposed acceptance criteria are measurable, such as removing long-lived cloud keys and testing detection of bursty enumeration. Risks include assuming detection equals disruption, which GTIG explicitly warns against."},"roleDetails":{"sales":{"customerProblem":"Agencies hear that AI-driven intrusions are inevitable and need a grounded view of what they look like and how to blunt them.","stakeholders":["State and local CISOs","Cloud and identity platform owners","SOC managers"],"discoveryQuestions":["Which cloud keys and service principals are long-lived today?","Could your SOC see 27 events in 23 seconds from one identity?","Who decides containment once an automated intrusion is detected?"],"valueHypothesis":"Tighter credentials and better telemetry may reduce the speed advantage of agentic tools; this source has no outcome data.","potentialEngagement":"A short credential-exposure and telemetry-coverage review based on GTIG's five defense layers.","unsupportedClaims":["That CrowdStrike's VAPOR PANDA figures are confirmed","That any product stops ARTEX","Counts of affected U.S. state or local agencies"]},"engineering":{"fit":"Agencies running hybrid Active Directory and public cloud workloads with service principals or access keys.","architectureIntegration":"Correlate identity, cloud control-plane, data-plane, network and endpoint telemetry to spot burst behavior.","prerequisites":["Inventory of cloud credentials and their lifetimes","Cloud audit logging enabled","Endpoint sensor coverage map"],"constraints":["No victim or sector counts","Competitor-authored research","Cloud examples centered on Azure and AWS"],"security":"Watch for rapid permission probing, DCSync, webshell writes via SQL logs and mass internal notifications.","proofOfValue":["Replay burst enumeration in a test tenant and confirm alerts","Rotate a long-lived key to short-lived and verify workloads still run","Measure time from alert to containment, not just detection"]},"delivery":{"work":"Credential hardening, control-plane restriction, segmentation and detection tuning for automated intrusions.","dependencies":["Cloud platform team","Identity team","SOC tooling and log retention"],"ownership":"Customer security operations lead, with cloud and identity owners.","skillsAdoption":"Analysts learn to recognize machine-speed bursts and noisy trial-and-error patterns.","governanceCheckpoints":["Credential lifetime policy approval","Post-exercise review of containment authority"],"acceptanceCriteria":["Proposed: no long-lived cloud access keys on production workloads","Proposed: burst-enumeration test detected and contained within an agreed time"],"risks":["Treating detection as disruption","Breaking workloads during credential rotation","Overreliance on static indicators"]}},"retrievedAt":"2026-11-02T08:36:06-06:00","enrichedAt":"2026-11-02T08:39:09-06:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Small public-sector security teams may struggle to triage noisy, high-volume bursts without automation or managed services.","procurementImplications":"None stated; buyers can ask vendors to show detection of the burst patterns GTIG describes rather than rely on vendor threat counts.","operatingModelImplications":"GTIG notes that detection alone does little to stop objective completion, so pre-authorized containment matters.","sourceVerification":{"openedUrl":"https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks","referenceExcerpt":"Their operations collectively impacted organizations across government, technology, chemicals and materials, and manufacturing sectors in the US","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}