Actor Profile

ARTEX refers to both an agentic AI offensive security framework and the threat actors observed by Microsoft Threat Intelligence using this tooling. The actors leverage ARTEX's autonomous capabilities to automate the discovery of exposed secrets in public GitHub repositories and conduct rapid follow-on attacks against cloud environments. The framework enables threat actors to minimize hands-on-keyboard interaction throughout the attack chain, accelerating all stages from initial reconnaissance to data exfiltration. Attribution details regarding the specific threat actor(s) behind these operations remain limited; Microsoft's reporting focuses on the tooling and tradecraft rather than a named APT or cybercrime group. The motivation appears to be credential harvesting and cloud resource compromise, with observed activity dating back to at least August 2024 and active exploitation campaigns beginning October 28, 2024.

TTPs (Tactics, Techniques, Procedures)

The ARTEX-enabled operations demonstrate multiple MITRE ATT&CK techniques across the attack lifecycle. Initial Access is achieved via exposed credentials discovered through automated scanning of public GitHub repositories (T1078.004 - Valid Accounts: Cloud Accounts). The agentic framework conducts Discovery operations (T1580 - Cloud Infrastructure Discovery) by querying GitHub with targeted search terms including organization names, secret keywords, cloud service identifiers, and AI service provider keywords. Following credential compromise, actors perform Credential Access activities including exfiltration from Azure Key Vault (T1552.001 - Unsecured Credentials: Credentials In Files) and abuse of valid OAuth application credentials for authenticated access (T1550.001 - Use Alternate Authentication Material: Application Access Token). Collection and Exfiltration techniques include data theft from Azure Storage Accounts and Key Vaults, with observed dwell time as short as five minutes from initial GitHub scanning to Azure Key Vault exfiltration. Additional observed TTPs include abuse of Azure AI services, attempts to obtain App Service authentication tokens, vulnerability exploitation via embedded shell commands in user agents, and use of Tor infrastructure (199.19.77[.]18) for operational security. The multitenant application credential compromise technique enabled lateral movement across multiple downstream customer tenants from a single vendor-owned application compromise.

Targets & Patterns

The campaign primarily targets organizations in the Technology sector, though the automated nature of ARTEX scanning suggests opportunistic targeting based on exposed credential availability rather than highly selective victim profiling. Victims include organizations with public GitHub repositories containing exposed secrets, particularly those using OAuth applications with client secrets stored in configuration files, scripts, or other code. The multitenant application compromise pattern indicates that cloud service vendors and SaaS providers represent high-value targets, as compromise of vendor-owned applications enables cascading access to multiple downstream customer tenants. Organizations with Azure cloud deployments, Microsoft 365 environments, and Azure AI service workloads are specifically at risk. The threat actors demonstrate interest in AI-related infrastructure, with observed reconnaissance operations targeting AI workloads deployed on Azure AI services and searches for AI inference-related API keys. The rapid automation enabled by ARTEX means any organization with exposed secrets in public repositories faces elevated risk regardless of size or profile, as the framework eliminates traditional time constraints that previously limited manual secret harvesting operations.

Historical Context

The use of ARTEX represents an evolution in the well-documented technique of scanning public code repositories for exposed credentials. Historically, this tradecraft has been limited by the time required for human operators to locate repositories, review contents, and operationalize discovered authentication material. The introduction of agentic AI frameworks like ARTEX marks a significant acceleration in attack velocity, with Microsoft observing progression from GitHub scanning to Azure Key Vault data exfiltration in as little as five minutes. Microsoft began observing ARTEX-enabled GitHub scanning activity in August 2024, with successful follow-on exploitation campaigns involving compromised service principal sign-ins detected as early as October 28, 2024. The campaign involving IP addresses 199.19.77[.]84 and 199.19.77[.]18 continued through at least early 2025. Additional malicious infrastructure at 65.87.223[.]26 and 157.22.126[.]128 has been linked to potentially related campaigns, with Todyl independently reporting activity involving the same IP addresses. This activity illustrates an ongoing trend of threat actors incorporating agentic AI penetration testing frameworks to accelerate all stages of the attack chain, representing a broader shift in offensive tradecraft that Microsoft assesses will require defenders to similarly adopt AI-driven investigation and response capabilities.

Defensive Recommendations

  • Immediately scan all organizational GitHub repositories for exposed secrets, credentials, and API keys; enable GitHub secret scanning with public monitoring to detect leaks in secondary repositories across the platform, and implement push protection to block secrets before commit
  • Rotate all exposed credentials, keys, and OAuth application secrets discovered in public repositories; removal of disclosed secrets from code alone does not remediate exposure as credentials remain valid until explicitly revoked or rotated
  • Migrate OAuth applications away from secret-based authentication to managed identities (Azure) or workload identity federation to eliminate the possibility of credential exposure in code and manual secret management processes
  • Monitor Entra ID sign-in logs for anomalous service principal authentication activity, particularly from suspicious IP addresses (199.19.77[.]84, 199.19.77[.]18, 65.87.223[.]26, 157.22.126[.]128) or Tor exit nodes; investigate multitenant application sign-ins for unauthorized downstream tenant access
  • Enable Microsoft Defender for Cloud protections for Azure Key Vault, Storage Accounts, and Azure AI services; implement least privilege access controls for service principals and enforce Conditional Access policies restricting cloud resource access to known IP ranges and compliant devices