Search — “agentic”

Microsoft reports that Cambodia-based Storm-3358 began targeting financial organizations in October 2026, mainly in Southeast Asia, using the ARTEX agentic AI offensive framework. The actor exploits internet-facing web flaws such as anonymous file upload and SSRF, places web shells, and has ARTEX agents use curl and netcat to download WISP, vshell and AdaptixC2 RATs for persistence and lateral movement. Microsoft also reports abuse of compromised cloud identities for persistence and exfiltration. Hunters should look for new curl downloads, shells spawned from web/PHP processes, bursts of machine-speed scanning with default tool user agents (Nmap, curl, wget, Python, Playwright), and connections to the published C2/ARTEX IPs.

Chainalysis said an agentic cyber attack led to an on-path attack that exposed a subset of customer passwords, and that its investigation also exposed names, usernames, password hashes and live tokens for all users. The company removed access to Reactor and Data Solutions, took KYT offline, locked impacted accounts, and said it has no evidence investigation data was accessed or attribution data manipulated. Customers should reset passwords, rotate API keys, and reuse trusted-IP allowlisting for access restoration; hunters should watch for reuse of stolen credentials against Chainalysis services and related cloud tenants.

Microsoft observed threat actors using the ARTEX agentic AI framework to search GitHub for exposed secrets, then use leaked app credentials for service principal sign-ins (from 199.19.77[.]84 / 199.19.77[.]18 since 2026-10-28) across multiple tenants. The agents enumerated Azure resources, read Key Vault secrets, storage keys, App Service settings, accessed SharePoint/OneDrive and Graph, used VM Run Command, and searched Azure DevOps for secrets; one case went from GitHub search to Key Vault exfiltration in five minutes. Hunt for SPN sign-ins with AADSTS7000215/7000222 failures followed by success, one IP authenticating to 3+ service principals, and ARM 400-then-200 retries differing only in api-version.

Check Point Research found 2,557 hosts that host or have hosted panels of ARTEX, a Chinese open-source AI pentest platform (1,608 live), and analyzed 10 instances with exposed databases. Operators set goals and let LLM agents (mostly Deepseek Flash) autonomously exploit web flaws: hardcoded admin creds in JS bundles, unauthenticated APIs, command injection, SSTI, IDOR. Confirmed outcomes include theft of 300+ iOS .p12 certs (3 valid), ~190,000 game credentials, and S3 write access enabling supply-chain tampering; the crypto-draining attempts moved no funds. Hunters should look for high-volume, residential-proxy-sourced automated probing of web endpoints and JS bundles, and for exposed ARTEX panels in clustered infrastructure.

OpenAI describes an agentic pipeline using an upcoming cyber-focused AI model that identified 2,308 candidate Linux kernel findings, reproduced 1,724, and produced 948 working local privilege escalation exploits for a commonly used Linux distribution at a cost of $1,213,430 in API credits. The pipeline also includes patch generation and human review before reporting to maintainers. The source describes a research prototype and reports no observed attacker use, so hunters should treat this as a patching and exposure-awareness item rather than an active campaign.

Blockchain analytics firm Chainalysis disclosed a breach first reported October 30 and later said names, usernames, password hashes and live tokens for all users were exposed to a malicious actor. The company said some customer passwords were exposed in an on-path attack and some KYT accounts appeared accessed, and it took several products offline. The sources do not identify the attacker or confirm how the attacker used agentic techniques, and Chainalysis said it has no evidence investigations data was accessed; hunters should watch for suspicious logins and token reuse against Chainalysis-hosted services.

GTIG and Mandiant report PRC-nexus UNC7228 (overlaps STORM-0940) and financially motivated groups operating open-source agentic pentest frameworks (ARTEX, PentAGI, CAIRN, Hexstrike) in real intrusions since late August 2026, with confirmed compromise and data theft. ARTEX used supplied valid credentials to probe Azure/AWS permissions, poison MySQL general_log into JSP webshells, abuse Kudu APIs, Kerberoast/DCSync, and post output to rotating webhook.site URLs via curl. Hunt for 2–25 second bursts of API calls, artex-probe-*/ArtexProbe artifacts, MySQL SET GLOBAL general_log_file changes, and server egress to webhook.site.

Blockchain analytics firm Chainalysis disclosed that an external actor used what it calls "offensive agentic techniques" to gain unauthorized access to internal systems and tools earlier in the month. Accessed customer data includes user IDs, full names, email addresses, and organizational role labels, while the company says no investigation content, authentication credentials, or session tokens were found accessed. No technical details (vulnerabilities, tools accessed, dwell time) have been shared, so hunters should rely on the vendor's advice to watch for password reset requests, unexpected authentication prompts, and impersonation scams targeting customers.

A sponsored BleepingComputer article by Keep Aware argues that AI agents can act inside authenticated browser sessions through Chrome DevTools Protocol debugging, AI extensions such as Claude in Chrome, agentic browsers, and the emerging WebMCP standard. It reports no confirmed compromise or observed attack. Hunters may consider inventorying debuggable browsers, AI extensions and their permissions (scripting, tabs, debugger API), and agentic browsers across the fleet.

Microsoft Threat Intelligence reports that multiple North Korean actors (Jade Sleet, Onyx Sleet, Coral Sleet, Diamond Sleet, Pearl Sleet, Sapphire Sleet, Jasper Sleet, Emerald Sleet) use generative and agentic AI for reconnaissance, persona creation, tailored lures, and tooling. The source says Cursor-type AI development platforms likely helped Coral Sleet, Jade Sleet, Pearl Sleet, and Sapphire Sleet with code and persistence work, and that Onyx Sleet and Pearl Sleet used the open-source ARTEX agentic penetration testing framework. It describes over 100 PDF lures attributed to Onyx Sleet, created in August and September 2026, with dozens generated within minutes. Hunting guidance in the visible text is mitigation-oriented; the post references Microsoft Defender detections without printing specific rules or log patterns.

CrowdStrike reports China-nexus VAPOR PANDA used the ARTEX agentic AI framework (DeepSeek plus a commercial LLM) against 200+ organizations in 14+ countries starting Oct 17, 2026, with confirmed post-exploitation at nine organizations including financial-sector targets in the US. Tradecraft included unsigned SAML assertions and XXE to query cloud IMDS, web shells, LAPS reads, RBCD impersonation, forged mail admin tokens, VPN access with leaked keys, password spraying, and checks for hosts lacking Falcon via tasklist. BLOODALCHEMY was sideloaded via a renamed GameHook binary (svchost.exe) loading graphics-hook-filter64.dll. Hunt for artx/artex command-line strings, artx-prefixed cloud roles, art18- admin-command comments, C:\ProgramData\artx5v\, and svchost.exe outside System32 loading graphics-hook DLLs.

Cohere reported that the open-weight model Qwen3.8-Flash-Next, while writing a detection rule, produced a shell command attempting to send a test string to an Alibaba Cloud storage address in Beijing, which Cohere's sandbox blocked. Check Point replayed the trace and sampled 64 completions, finding 52 distinct destination hosts including local addresses and nonexistent domains, and concluded model jaggedness is the most likely explanation rather than a fixed backdoor. Hunters with agentic LLM deployments may look for unrequested curl upload commands issued by model tool-call processes, though the source does not provide detection content.

Microsoft Corporate Vice President Aarti Borkar's blog post frames two CISO priorities: governing AI agents through observability, governed identities, and data protection, and modernizing defense through integrated signals, threat intelligence, and agentic security operations. The post cites Microsoft's Work Trend Index (agent count growth) and Digital Defense Report but describes no specific intrusion, vulnerability, or threat actor. It is strategic commentary with no huntable adversary behaviors or indicators.

Google Project Zero compared the Fuzzilli JavaScript engine fuzzer and the BigSleep LLM-based agentic bug finder on V8 vulnerabilities from April to September 2026. In production, BigSleep and Fuzzilli reported 45 and 37 actionable vulnerabilities respectively with roughly 25% overlap, while a dedicated experiment re-discovered about 62% of historic Fuzzilli bugs with BigSleep. The post concludes the two approaches are complementary and recommends vendors run both fuzzing and agentic code analysis; it describes no attacker activity or detectable behavior.

Warp, an agentic development environment, says a third-party vendor in its infrastructure was attacked, exposing agent decision logs and telemetry data for roughly 1% of its users. The company says it detected the activity within hours, has notified affected users, and engaged CrowdStrike and law enforcement; it has not clarified whether source code, prompts, or credentials were exposed. No technical behaviors, indicators, or detection details are published in the source.

CrowdStrike Counter Adversary Operations reports four previously unreported threat actors running campaigns in which AI agents (Claude Code-based pentesting harnesses) make decisions and execute commands against healthcare, government, private-sector and a U.S. CRM vendor. The actors left their offensive agent frameworks exposed via open directories. Defenders should watch for Claude Code agents driving exploitation workflows, such as the /pentest-setup slash command and MCP-based harnesses derived from PentestGPT, though the source does not print log-level artifacts beyond those names.

Microsoft attributes the ConnectWise Cloud Backup supply chain compromise to China-aligned Storm-0940, which used the ARTEX agentic AI framework to password-spray (151,000+ failures, Oct 10-14) and then abuse stolen ConnectWise app identities to authenticate to 2,250+ M365 tenants from Oct 15. Follow-on Graph activity included reconnaissance, application credential additions for persistence, and privileged role changes (including app self-assignment of Global Administrator). Hunt service-principal sign-ins for the ConnectWise app IDs back to Oct 1, Entra audit for credential/role/consent changes, and the listed IPs and Python/curl user agents.

A SecurityWeek contributed opinion piece by Matias Madou argues that agentic AI software development expands attack surface faster than traditional controls can follow. It cites SonarSource noting that frontier LLMs that write the most functional code also produce the most severe security vulnerabilities. The article proposes a three-phase, eight-stage AI Adoption Model and recommends governance, observability of AI tool use, and tracking of AI-driven commits. No specific threat actor, malware, CVE, or exploitation activity is described.

A sponsored BleepingComputer article by Picus Security argues that agentic AI pentesting cannot reach all assets because of safety restrictions and network reachability, and cannot test CVEs lacking public exploits. It cites an nginx-ui authentication bypass (CVE-2026-33032) where agentic testing covered only 120 of 480 instances. The piece promotes exposure validation and breach simulation as complements; it describes no adversary behavior or detectable artifacts.