AI-Enabled Ransomware Evolution: Machine-Speed Kill Chains and Initial Access Broker Disruption (TrendAI Assessment, ARTEX Agentic Exploitation Context)

Key facts

Detection coverage

As of 2026-11-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-6007 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ARTEX-Style Agentic Password Spraying Against Entra ID and Okta (TL-2026-6007)

Detects machine-speed password spraying (about one attempt per second, many distinct users, rotating source IPs) against Microsoft Entra ID or Okta, the agentic pattern Obsidian attributes to ARTEX-driven intrusions in TL-2026-6007. Obsidian reports successful paths mostly used already-valid credentials, so catching the spray before the first success is the key window.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1110.003, T1078.004
• Data sources: entra_id_signin, okta_system_log
• Severity: high
• Confidence: high

Splunk SPL

(index=azure sourcetype="azure:aad:signin" properties.status.errorCode IN (50126,50053,50034)) OR (index=okta sourcetype="OktaIM2:log" eventType="user.session.start" outcome.result=FAILURE) earliest=-60m
| eval src_ip=coalesce('properties.ipAddress','client.ipAddress'), target_user=coalesce('properties.userPrincipalName','actor.alternateId'), idp=if(index=="okta","okta","entra_id")
| bin _time span=1m
| stats count AS attempts dc(target_user) AS distinct_users dc(src_ip) AS distinct_ips values(src_ip) AS src_ips BY idp _time
| where attempts>=45 AND distinct_users>=20
| table _time idp attempts distinct_users distinct_ips src_ips

Microsoft KQL

SigninLogs
| where TimeGenerated > ago(1h)
| where ResultType in ("50126", "50053", "50034")
| summarize attempts = count(), distinct_users = dcount(UserPrincipalName), distinct_ips = dcount(IPAddress), src_ips = make_set(IPAddress, 50) by AppDisplayName, bin(TimeGenerated, 1m)
| where attempts >= 45 and distinct_users >= 20
| project TimeGenerated, AppDisplayName, attempts, distinct_users, distinct_ips, src_ips

Sigma

title: Agentic Password Spraying Against Entra ID (ARTEX Pattern)
id: 7c1d2b64-5a3e-4f08-9b1a-3e5d6f7a8b01
status: experimental
description: Failed Entra ID sign-ins with invalid credentials, unknown user or locked account codes. Pair with a Sigma correlation (event_count of 45 or more per minute, value_count of user of 20 or more) in your backend to detect machine-speed password spraying as seen with ARTEX in TL-2026-6007.
references:
    - https://www.infosecurity-magazine.com/news/ai-revolutionize-ransomware/
    - https://www.obsidiansecurity.com/blog/artex-and-the-rise-of-agentic-exploitation-hours-not-days-to-privileged-access
author: Threadlinqs Team
date: 2026/11/13
tags:
    - attack.credential-access
    - attack.initial-access
    - attack.t1110.003
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection:
        ResultType:
            - '50126'
            - '50053'
            - '50034'
    condition: selection
falsepositives:
    - Users mistyping passwords after a forced reset
    - Misconfigured service accounts with stale credentials
    - Authorized red team spray exercises
level: medium

Known false positives:

• Corporate NAT egress where many users fail sign-in after a password reset
• Authorized password-spray assessments or red team exercises
• Legacy clients with cached bad credentials after a mass password rotation

Tuning notes: Raise the attempts and distinct_users thresholds for very large tenants. Allowlist known pentest source IPs and corporate egress ranges. Add a join on later success (ResultType 0) from the same src_ip to escalate severity. Adjust the Okta index and sourcetype to your deployment.

• 🔒 ConnectWise Cloud Backup App Credential Abuse (Service Principal Sign-In Anomalies) · unlock with TL Creds
• 🔒 Kerberoasting: Burst of RC4 Service Ticket Requests Across Many SPNs · unlock with TL Creds
• 🔒 Automated Vulnerability Scanning and Exploit Probing of Public Web Apps · unlock with TL Creds
• 🔒 AI Offensive Framework Execution (ARTEX, ScopeWeaver, HexStrike AI, CyberStrikeAI, PentAGI) · unlock with TL Creds
• 🔒 Credential Hunting in Files (Recursive Search for Passwords, .env and Private Keys) · unlock with TL Creds
• 🔒 Cobalt Strike Default Named Pipes (C2 Co-Located With ARTEX Infrastructure) · unlock with TL Creds
• 🔒 Azure Key Vault Bulk Secret Reads by a Single Identity (Agent-Speed Credential Harvest) · unlock with TL Creds
• 🔒 Outbound Connections to ARTEX Console Ports (8787/8790) and Community-Observed C2 Hosts · unlock with TL Creds

Indicators of compromise

As of 2026-11-13, Threadlinqs Intelligence tracks 15 indicators of compromise for TL-2026-6007.

Technical analysis

This is a forward-looking expert assessment, not a confirmed ransomware incident.

This record documents a forward-looking trend assessment, not a confirmed intrusion set. Per Infosecurity Magazine (James Coker, 13 Nov 2026), Bob McArdle of TrendAI described ransomware as 'pretty stagnant and boring for the past couple of years'. Today, ransomware actors mainly use AI to speed up and streamline campaigns: AI tools that locate the most valuable data in a victim environment, and chatbots that handle initial ransom negotiations. McArdle called this 'a drop in the ocean' compared with what is coming. The core operating model is unchanged: initial access brokers (IABs) feeding ransomware crews that run double extortion.

Predictions (expert opinion, not observed fact): (1) 2027 is when ransomware will be 'revolutionized' by AI. (2) AI frameworks such as ARTEX lower the barrier to finding and exploiting vulnerabilities, so any internet-connected system that is misconfigured or vulnerable will be compromised; this is expected to devalue the IAB market and push brokers to sell privilege escalation to ransomware groups instead. (3) After initial access, ARTEX and AI agents compress the kill chain to machine speed. (4) Organizations consolidating data for AI adoption create new targets; groups may threaten to tamper with the AI orchestration around that data as an additional extortion lever. (5) AI makes it easier to build high-value datasets for sale to other criminals, with an expected 'inflection point' in 2027 as extortion and data-sale models grow side by side. (6) More ransomware groups over the next year, followed by 'hostile takeovers' of smaller groups by Conti- and LockBit-level groups for their technology or affiliate networks.

Supporting context on ARTEX from separate reporting: ARTEX is an open-source, model-agnostic multi-agent AI penetration-testing framework published to GitHub by developer Autumn-27 on 26 Jul 2026 (AGPL-3.0). It uses planner agents and worker agents with a command shell and shared discovery record, and can connect to Anthropic, OpenAI or OpenAI-compatible APIs. The developer closed the source in October 2026 after misuse, but forks and backups (for example ARTEX PRO, ScopeWeaver) circulate. CrowdStrike reports the China-linked VAPOR PANDA used ARTEX from 17 Oct 2026 against 200+ organizations (14 countries per Obsidian) in under two weeks, with confirmed post-exploitation at nine. Microsoft reports Storm-0940 attempted sign-ins to 2,250+ Microsoft 365 tenants using stolen ConnectWise Cloud Backup app credentials and reached privileged cloud access in under three hours in several cases. Google Threat Intelligence Group reports financially motivated extortion crews using ARTEX in incident response cases since late August. Check Point (5 Nov 2026) describes largely autonomous, financially motivated criminal use and counts 1,608 live ARTEX panels (2,557 hosted at some point). Censys counted 1,465 exposed ARTEX consoles on 4 Nov 2026 (default port 8787). None of this ARTEX reporting names ransomware deployment; it is context for the plausibility of the TrendAI forecast. Obsidian notes successful paths mostly used already-valid credentials, keys or app identities rather than novel exploits, so conventional identity and exposure hygiene remains the main defense.

Source limitations: the TrendAI assessment is known only through a single conference-talk news report. It contains no CVEs, IOCs, CVSS, named ransomware families (beyond Conti and LockBit as examples of large groups) or defensive guidance. IRISSCON attendance could not be corroborated by independent search. Indicators below are tool, actor and infrastructure-pattern indicators drawn from the ARTEX context reporting; no IPs, domains or hashes were published in the sources reviewed.

MITRE ATT&CK techniques by tactic:

Discovery

T1046 Network Service Discovery

Initial Access

T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application; T1195 Supply Chain Compromise

Credential Access

T1110.003 Password Spraying; T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1555.006 Cloud Secrets Management Stores; T1558.003 Kerberoasting

Resource Development

T1583.003 Virtual Private Server; T1588.007 Artificial Intelligence

Reconnaissance

T1593.003 Code Repositories; T1595.002 Vulnerability Scanning

Impact

T1657 Financial Theft

Remediation

Patches

• Apply vendor patches for exposed web application vulnerabilities (for example remote code execution flaws), the practical defense cited by Check Point

Immediate actions

• Inventory and patch internet-facing systems; remediate misconfigurations and exposed admin consoles, since AI frameworks lower the cost of finding and exploiting them
• Rotate credentials, API keys and OAuth app secrets; scan public code repositories for exposed secrets
• Alert on high-volume or one-second-interval sign-in attempts and rapid IP rotation against Entra ID and Okta
• Review third-party app and integration credentials (for example vendor backup apps) and revoke unneeded standing OAuth tokens

Workarounds

• Restrict management consoles and cloud key stores to trusted networks; add monitoring on Key Vault reads
• Maintain offline, immutable backups as a baseline ransomware control

Longer-term hardening

• Enforce MFA where it applies and apply least privilege to human, service and agent identities
• Maintain an inventory of third-party apps, their permissions and authentication methods; retire dormant apps
• Baseline normal integration behavior and alert on deviations across identity providers
• Secure and monitor the AI orchestration layer and consolidated data stores that AI deployments depend on, since tampering with them is a predicted extortion lever
• Develop and test incident response plans for agent-driven, machine-speed intrusions, including tabletop cases where only minutes pass between access and privileged cloud actions

Affected and fixed versions

• Various — Internet-facing systems that are misconfigured or vulnerable; cloud identity providers (Microsoft Entra ID, Okta) and consolidated data stores behind AI orchestration

Timeline

• 2026-07-26 ARTEX open-source AI penetration-testing framework published on GitHub by developer Autumn-27 under AGPL-3.0.
• 2026-08-18 Censys later reports open directories on a server named in CrowdStrike's VAPOR PANDA report were visible from this date, about seven weeks before that report.
• 2026-10-08 ARTEX developer makes the project closed-source after misuse, including attacks on South Korean banks; forks and backups such as ARTEX PRO and ScopeWeaver continue to circulate.
• 2026-10-17 VAPOR PANDA (China-linked, CrowdStrike) begins using ARTEX, targeting 200+ organizations in under two weeks with confirmed post-exploitation at nine.
• 2026-11-04 Censys counts 1,465 hosts running an exposed ARTEX console, with 32 open directories exposing post-exploitation kits.
• 2026-11-05 Check Point Research publishes analysis of largely autonomous, financially motivated ARTEX use (1,608 live panels); Microsoft reports an agent moving from search to Azure Key Vault exfiltration in five minutes.
• 2026-11-11 Bob McArdle of TrendAI presents the AI-ransomware assessment at IRISSCON 2026 in Dublin.
• 2026-11-13 Infosecurity Magazine publishes 'AI Set to Revolutionize Ransomware Following Stagnant Few Years' reporting the assessment.

Sources cited

• Censys finds ARTEX exposed consoles and open directories (via Implicator) implicator.ai · Research
• ARTEX and the Rise of Agentic Exploitation: Hours, Not Days, to Privileged Access (Obsidian Security) obsidiansecurity.com · Vendor report
• TrendAI research at RSAC 2026 (Hilt and McArdle on agentic AI cybercrime) Trend Micro · Vendor report
• AI Set to Revolutionize Ransomware Following 'Stagnant' Few Years (Infosecurity Magazine, James Coker) infosecurity-magazine.com · News · 2026-11-13
• ARTEX AI hacking framework spreads to another China-linked group (VAPOR PANDA, Storm-0940, GTIG) letsdatascience.com · News
• Check Point details autonomous ARTEX attacks by cybercriminals letsdatascience.com · News · 2026-11-06
• ARTEX AI pen-test tool: hackers' weapon (Dark Reading) Dark Reading · News

More in ransomware

• Ransomware Leak-Site Cadence Analysis: INCRANSOM, TheGentlemen and Audit Team Run Active Intrusion Pipelines Amid Group Consolidation
• Vexy Ransomware lists Upper Web (Brazil, Technology) as a victim
• Everest ransomware leak-site listing: "Final Notice Before Publication" (victim unnamed)
• Qilin Ransomware Claims Cyberattack on University of Texas at Arlington; Personal Data Stolen
• Ransomware attack on Belarusian cloud provider ActiveCloud disrupts hosting, email and virtual servers

Further reading

• Screensaver (.SCR) Files as Initial Access