Threat video1:00
ARTEX AI Attack on WorkOS Sales App: Detection & IOCs
An attacker used the ARTEX AI framework to automate access to WorkOS's internal sales app. Includes 9 detection rules, 14 IOCs and a free Splunk SPL rule.
Read the full threat intel for ARTEX AI Attack on WorkOS Sales App: Detection & IOCs →
Chapters
- 0:00The hookRoughly 3,000 WorkOS customers: AI framework breach.
- 0:05The storyARTEX automates reconnaissance and exploitation.
- 0:12Attack pathAccording to reports, attackers obtained ARTEX for recon.
- 0:29AttributionNo threat actor is attributed.
- 0:33Indicators of compromise5 indicators to hunt: 5 IPs.
- 0:39MITRE ATT&CK techniques9 ATT&CK techniques, from reconnaissance to collection.
- 0:43Remediation5 steps now: Hunt web/proxy/WAF logs for the user agents.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Roughly 3,000 WorkOS customers: AI framework breach.
0:05ARTEX automates reconnaissance and exploitation.
0:09Attackers used it against WorkOS in October.
0:13According to reports, attackers obtained ARTEX for recon.
0:17Automated scanning probed the app.
0:19Then exploited the app.
0:21Accessed contact details and call summaries.
0:24WorkOS detected and disclosed the breach.
0:29No threat actor is attributed. Confidence: low.
0:345 indicators to hunt: 5 IPs.
0:399 ATT&CK techniques, from reconnaissance to collection.
0:445 steps now: Hunt web/proxy/WAF logs for the user agents.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.