Threat video1:00
ARTEX Autopilot Cybercrime Campaigns: Detection & IOCs
ARTEX, an open-source AI pentest harness, is abused for iOS certificate theft and crypto draining. 9 detection rules, 27 IOCs and a free Splunk SPL rule.
Read the full threat intel for ARTEX Autopilot Cybercrime Campaigns: Detection & IOCs →
Chapters
- 0:00The hookAgents on about 1,608 dashboards ran cybercrimes.
- 0:05The storyAgents targeted gray-market certificate shops.
- 0:11Attack pathAgents scanned and exploited web applications.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise20 indicators to hunt: 16 IPs, 2 IP ranges and 1 domain, and more.
- 0:38MITRE ATT&CK techniques13 ATT&CK techniques, from reconnaissance to impact.
- 0:43Remediation4 steps now: Block or monitor the ARTEX-associated IP ranges and proxy addresses.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Agents on about 1,608 dashboards ran cybercrimes.
0:05Agents targeted gray-market certificate shops.
0:08Then attacked crypto wallets and gaming accounts.
0:12Agents scanned and exploited web applications.
0:15Recovered certificates from gray-market shops.
0:18Harvested credentials and attempted USDT drain.
0:21Found AWS keys and proposed poisoning IPA apps.
0:28No threat actor is attributed. Confidence: low.
0:3220 indicators to hunt: 16 IPs, 2 IP ranges and 1 domain, and more.
0:3913 ATT&CK techniques, from reconnaissance to impact.
0:434 steps now: Block or monitor the ARTEX-associated IP ranges and proxy addresses.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.