It's one of the first real attacks documented in detail where AI doesn't just help write a phishing email but does almost the entire intrusion. I'll update this story if new details come out.

Updated November 8. It isn't an isolated case. Microsoft had already documented another group using ARTEX in a supply-chain attack, Google has seen extortion groups using it, and India's CERT is warning about attacks on its financial sector with this and similar tools. The WorkOS intrusion, which first looked like another attack, has been claimed by a researcher who says their agent escaped its test environment. Backdoored copies of ARTEX are also circulating. Details under "Not just one group".

◢What ARTEX is and how it works

ARTEX is what's known as an "agentic" framework: instead of a program following a fixed list of steps, a lead agent hands work out to other agents that plan and execute, and they all share what they find. According to CrowdStrike¹, each attack moves from initial access to network reconnaissance and on to other machines.

For their reasoning, the agents mainly used DeepSeek, the Chinese model, plus a second paid commercial model that CrowdStrike couldn't identify. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens, the unit used to measure and bill usage of these models.

◢Twelve minutes to take over a server

DIVD logged more than 450,000 requests and more than 2,500 scripts. A human attacker, it estimates, would have needed twenty or thirty. The agents created an administrator token with no expiry date, tried a 2019 flaw on a mail server, read one mailbox nine times and scanned the internal network. DIVD describes the attack as very loud and messy, and has filed a police report.

◢What role people played

The agents weren't working entirely alone. CrowdStrike found instructions in Chinese marked as "human instruction": an operator stepped in at key moments to decide where to go next, while the agents worked in parallel against several targets at once. At one pharmaceutical company, that operator told them to look for Windows machines that didn't have CrowdStrike's own security agent installed.

That's the important shift. One person can now run many attacks at once that used to need a whole team, and machines never get tired of trying.

◢Who's behind it, according to CrowdStrike

No victims have been reported in Spain or the UK. The targets do include institutions in one European country that CrowdStrike doesn't name: the foreign ministry, the presidency, the prime minister's office and defense, justice, finance and intelligence bodies.

◢How they got in

What strikes me most is that almost none of this is magic. The agents exploited configuration mistakes and oversights that any audit would have flagged: according to CrowdStrike¹, broken signature validation in single sign-on, internal services with no password and administrator access, credentials nobody had changed, and even a 2022 copy of a mail server's directory, with keys that were never rotated, which they used to forge an administrator token.

AI hasn't invented a new way in. What it does is try every badly locked door at once, very fast and without a break. If a company had just one, it finds it.

◢Not just one group

What WorkOS has explained is how it got in: a legacy internal tools platform without the protections of its newer systems, API endpoints exposed to the internet, a predictable credential meant for local development that had been left in production, and no rate limiting. The first access was on October 25 and went unnoticed until October 30, by which time the agent had downloaded the customer records: contacts, account history, product usage and summaries of sales calls and support conversations. Its warning to customers applies to everyone: with real contacts and past conversations, very convincing messages can be written, so verify any unexpected request before acting on it.

What changes the picture most for a small business comes from Google⁵. Its October 30 report, written with Mandiant, says it has seen ARTEX in real incident response cases, including financially motivated groups that used it for data theft and extortion. So this is no longer only about state espionage. Google adds something useful: these tools give up stealth for speed and leave plenty of traces, so watching your logs pays off.

◢What to do in your company

CrowdStrike's recommendations¹ and the lessons from the DIVD case come down to closing the doors you already know about:

• ▹Patch everything exposed to the internet, especially servers that have been running for years without anyone looking at them.
• ▹Change keys, service passwords and signing certificates after any suspected leak, even an old one. A forgotten export from years ago was enough here.
• ▹Check that single sign-on really validates signatures and that internal services require authentication, even if they're "only used internally".
• ▹Watch for mass password attempts and unusual mailbox access. An attack like this makes a lot of noise: if someone looks at the logs, it shows.
• ▹If someone on your team wants to try tools like this, avoid third-party copies and use a properly isolated environment. Unofficial ARTEX copies have already shipped backdoors, and the WorkOS case shows what happens when the test environment doesn't contain the agent.
• ▹And if your company runs its own AI agents, review what permissions they have and where you keep their API keys: what works for attacking can also be turned against you.

◢What this case leaves behind

For years, many small businesses have relied on a comfortable idea: "nobody's going to waste time on us". With agents attacking two hundred organizations in eleven days, that time is no longer needed. The attacker doesn't have to pick you: it's enough that you have one open door.

The good part is that almost everything they used can be fixed with basic hygiene and a team that knows what not to do. That's what I work on in my cybersecurity and AI training for companies.