From the CrowdStrike edition of November 1, 2026
Google Threat Intelligence Group and Mandiant: ARTEX and Friends — agentic offensive frameworks observed in incident response
Google Threat Intelligence Group (GTIG) and Mandiant · Cybersecurity threat intelligence; incident response across government and private sectors · Global, with U.S. government-sector victims reported
- Publisher
- Google Cloud Blog (Threat Intelligence)
- Original publication
- 2026-10-30
- Source retrieved
- 2026-11-02
What happened
GTIG and Mandiant report that since late August 2026 several threat actors have run ARTEX, PentAGI, CAIRN and custom harnesses during real intrusions they responded to, affecting U.S. government, technology, chemicals and manufacturing organizations. ARTEX ran in bursts of about 2 to 25 seconds (27 events in 23 seconds in one case), but it was 'far more forensically noisy' than a skilled human: one attempt produced 240 log events, and in one case endpoint protection blocked lateral movement. GTIG judges current use early-stage and 'broad and noisy, but still successful'. Why now: this is the first non-CrowdStrike, incident-response view of the ARTEX activity that CrowdStrike's Oct 29 VAPOR PANDA report centers on, while the Oct 31 edition found that every VAPOR PANDA figure rested on CrowdStrike alone.
Why it matters
Direct for state and local agencies: GTIG names U.S. government-sector organizations among those affected, without naming the level of government. For the CrowdStrike stream it is an independent check on CrowdStrike's framing: it agrees that ARTEX is used in real intrusions and moves fast, but stresses that the activity is noisy and detectable, which tempers vendor messaging that only machine-speed defense can keep up.
Evidence and measured results
Incident-response observations and research telemetry from Google/Mandiant, a CrowdStrike competitor. Independent of CrowdStrike, but not peer reviewed; victims are not named, case counts are not given, and the report does not assess VAPOR PANDA or test any CrowdStrike claim directly.
Limitations and uncertainty
Vendor research by a CrowdStrike competitor; no victim names, case counts or rate of success. The report does not mention CrowdStrike, so it corroborates the threat class, not CrowdStrike's attribution or figures. Published Oct 30, before the last run, and carried today because it was missed then and remains current.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-11-02; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Agencies hear that AI-driven intrusions are inevitable and need a grounded view of what they look like and how to blunt them.
- Stakeholders
- State and local CISOs
- Cloud and identity platform owners
- SOC managers
- Discovery questions
- Which cloud keys and service principals are long-lived today?
- Could your SOC see 27 events in 23 seconds from one identity?
- Who decides containment once an automated intrusion is detected?
- Value hypothesis
- Tighter credentials and better telemetry may reduce the speed advantage of agentic tools; this source has no outcome data.
- Potential engagement
- A short credential-exposure and telemetry-coverage review based on GTIG's five defense layers.
- Unsupported claims
- That CrowdStrike's VAPOR PANDA figures are confirmed
- That any product stops ARTEX
- Counts of affected U.S. state or local agencies
Pre-sales engineering
Role takeaway
- Fit
- Agencies running hybrid Active Directory and public cloud workloads with service principals or access keys.
- Architecture and integration
- Correlate identity, cloud control-plane, data-plane, network and endpoint telemetry to spot burst behavior.
- Prerequisites
- Inventory of cloud credentials and their lifetimes
- Cloud audit logging enabled
- Endpoint sensor coverage map
- Constraints
- No victim or sector counts
- Competitor-authored research
- Cloud examples centered on Azure and AWS
- Security
- Watch for rapid permission probing, DCSync, webshell writes via SQL logs and mass internal notifications.
- Proof of value
- Replay burst enumeration in a test tenant and confirm alerts
- Rotate a long-lived key to short-lived and verify workloads still run
- Measure time from alert to containment, not just detection
Delivery
Role takeaway
- Work
- Credential hardening, control-plane restriction, segmentation and detection tuning for automated intrusions.
- Dependencies
- Cloud platform team
- Identity team
- SOC tooling and log retention
- Ownership
- Customer security operations lead, with cloud and identity owners.
- Skills and adoption
- Analysts learn to recognize machine-speed bursts and noisy trial-and-error patterns.
- Governance checkpoints
- Credential lifetime policy approval
- Post-exercise review of containment authority
- Acceptance criteria
- Proposed: no long-lived cloud access keys on production workloads
- Proposed: burst-enumeration test detected and contained within an agreed time
- Risks
- Treating detection as disruption
- Breaking workloads during credential rotation
- Overreliance on static indicators
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Defenses GTIG recommends are architectural: control-plane isolation, short-lived scoped credentials, least privilege, segmentation of application tiers and behavioral detection based on identity, control-plane, data-plane and network telemetry.
Governance
Who approves, reviews and stays accountable for outcomes?
Agencies should require incident reports to separate tool presence, execution, success and attribution, and should check where cloud credentials and service principals are long-lived.
Security and privacy
What data, permissions and controls need testing?
Observed activity includes harvesting Azure storage keys, DCSync of domain secrets, mass database reads and abuse of a notification system to email over 1,300 internal users.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Small public-sector security teams may struggle to triage noisy, high-volume bursts without automation or managed services.
Procurement
What should contracts, pricing and exit terms secure?
None stated; buyers can ask vendors to show detection of the burst patterns GTIG describes rather than rely on vendor threat counts.
Operating model
Which teams own the service once it runs?
GTIG notes that detection alone does little to stop objective completion, so pre-authorized containment matters.
Publication history
- 2026-11-01CrowdStrike · Issue 042 resources
Stable resource ID: gtig-artex-agentic-offensive-frameworks-in-the-wild-2026