Founder of ThreatBook. ex Microsoft TwC, ex Amazon InfoSec.
Joined March 2009
- Tweets255
- Following3.6K
- Followers2.2K
- Likes142
Is Artex the new Metasploit?
An update on the WorkOS security incident:
Shortly after our original bulletin, a security researcher contacted us and claimed responsibility. They told us they were evaluating ARTEX, an autonomous penetration testing framework, when their agent escaped its isolated testing environment and interacted with WorkOS unintentionally.
We asked for technical evidence. The researcher provided request details, timestamps, and artifacts from the activity. Our security team and an independent forensic investigator matched that evidence against our logs, establishing with high confidence that this individual was responsible for the unauthorized activity we observed.
The researcher has confirmed that all WorkOS data obtained by their agent has been deleted and was not shared with anyone else.
Their explanation that the activity was unintended does not change how seriously we take the incident or our responsibility to our customers.
Full report: workos.com/security/bulletin…
7
1,031
Feng Xue retweeted
🛡️𝗗𝗲𝗳𝗲𝗻𝗱𝗶𝗻𝗴 𝗮𝗴𝗮𝗶𝗻𝘀𝘁 𝗔𝗥𝗧𝗘𝗫 𝗮𝗻𝗱 𝗖𝘆𝗯𝗲𝗿𝗦𝘁𝗿𝗶𝗸𝗲𝗔𝗜 🧙♂️
This query checks 𝙳𝚎𝚟𝚒𝚌𝚎𝙽𝚎𝚝𝚠𝚘𝚛𝚔𝙴𝚟𝚎𝚗𝚝𝚜 for successful inbound connections from IPs found in the 𝗔𝗥𝗧𝗘𝗫 and 𝗖𝘆𝗯𝗲𝗿𝗦𝘁𝗿𝗶𝗸𝗲𝗔𝗜 threat feeds.
A simple way to bring external threat intelligence into Advanced Hunting and look for potential hits.
KQL Detection:
detections.ai/share/rule/4aY…
Credit to Feng Xue for the ThreatBook feeds. 🙌
#ThreatHunting #KQL #MicrosoftDefender #ThreatIntelligence
This is being updated on a daily basis
Since the folks at ThreatBook developed both Artex and CyberStrikeAI, we figured we should contribute a bit to defending against and tracking AI agent attacks by sharing two feeds of instances running these agents on the public internet.
Grab them if needed. Feeds:
threatbook.io/hubfs/Feeds/AR…
threatbook.io/hubfs/Feeds/CS…
This is interesting. Is this the first case where models being able to discover/create novel exp techniques?
The agents also discovered and used at least 10 Linux exploitation techniques that, to the best of our knowledge and all of the experts that we consulted, are novel.
This suggests frontier LLMs can discover and patch new approaches to exploitation, beyond simply applying known techniques.
1
4
678
Among the 4 abused open source agents, 3 of them has professional edition available on RedAgents.ai
Test yourself before attackers.
Holy Shit. In a new critical advisory issued TODAY, India's cyber agency CERT-In says hackers are using AI-assisted tools to attack financial institutions, exploiting payment APIs and testing transfers with just ₹1 before moving larger sums.
CERT-In identifies the group as CRAFTY FALCON and says it is using FOUR publicly available AI offensive-security systems: ARTEX, PentAGI, Cairn and CyberStrikeAI.
The campaign is still succeeding against fintechs and NBFCs, including firms that had already been warned and attempted remediation. Some were deliberately targeted AGAIN, while attackers are timing intrusions around weekends and holidays when security monitoring is lower.
Since the folks at ThreatBook developed both Artex and CyberStrikeAI, we figured we should contribute a bit to defending against and tracking AI agent attacks by sharing two feeds of instances running these agents on the public internet.
Grab them if needed. Feeds:
threatbook.io/hubfs/Feeds/AR…
threatbook.io/hubfs/Feeds/CS…
it is based on my test on dozens of large organizations, almost 100% RCE. authorized test of course.
3
112
Harness still matters a lot. Try Artex open source version. It has been taken offline but you can find forks - be careful with the rogue ones
5
699