Datadog reports ARTEX agentic attacks on AWS using IAM keys

Datadog observed in-the-wild activity from ARTEX, an AI-native penetration framework, targeting AWS environments to access financial data and secrets. Operators use hosted web consoles and supply API keys to various LLM providers to orchestrate automated attacks. The framework has been tied to threat actors like Storm-0940 and utilizes vectors such as compromised IAM keys and unauthenticated Amazon Cognito user pool sign-ups. Open article →