Jekyll2026-11-05T11:28:24+00:00https://ramimac.me/feed.xmlHigh Signal SecurityCloud security research and engineering insights by Rami McCarthy.ramimacARTEX: A Family, Not a Tool2026-11-05T11:24:27+00:002026-11-05T11:24:27+00:00https://ramimac.me/artex-familyARTEX is one of the biggest names in agentic attacks.

GTIG, Microsoft, CrowdStrike, Unit 42, and AhnLab have all documented ARTEX’s emergence in real intrusions. Throughout Black October and beyond, companies have begun directly linking ARTEX to their incidents.1

ARTEX isn’t a monolithic tool. On October 8th, its author took ARTEX closed source. Meanwhile, direct forks, forked descendants (like ScopeWeaver), and even backdoored copies have proliferated.

The branches share code, swap TTPs, and muddy attribution.

ARTEX is only one of the many agentic attack(er) tools cropping up.2

  1. Don’t overrotate to the tool. Defend against the pattern: agentic frameworks running real intrusions.
  2. When you hear “ARTEX,” think family, not tool.

  1. Kernel, WorkOS ↩

  2. Hermes, Strix, Shannon, PentestGPT, Cairn, Hexstrike AI, PentAGI, CyberStrikeAI, Phantom, aiscan, and more ↩

]]>ramimac“Black October” for AI Developer Platforms2026-10-30T19:00:00+00:002026-10-30T19:00:00+00:00https://ramimac.me/black-octoberramimacGheist: Attempted Scaled Abuse of Stolen GitHub Tokens Stumbles2026-10-25T19:00:00+00:002026-10-25T19:00:00+00:00https://ramimac.me/gheistramimacARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors2026-10-22T19:00:00+00:002026-10-22T19:00:00+00:00https://ramimac.me/artex-storm-0940ramimacLiteLLM Compromised, Steals Credentials2026-10-21T19:00:00+00:002026-10-21T19:00:00+00:00https://ramimac.me/litellm-compromisedramimacRust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns2026-08-20T19:00:00+00:002026-08-20T19:00:00+00:00https://ramimac.me/arrayref-dprkramimacInside the Metabase SQLi: Exploited in the Wild2026-08-10T19:00:00+00:002026-08-10T19:00:00+00:00https://ramimac.me/metabase-sqliramimackeyv and cacheable npm Package Hijacked in Supply Chain Attack2026-08-04T19:00:00+00:002026-08-04T19:00:00+00:00https://ramimac.me/keyv-cacheable-supply-chainramimacM-Red-Team: AsyncAPI Supply Chain Compromise via GitHub Actions2026-07-14T19:00:00+00:002026-07-14T19:00:00+00:00https://ramimac.me/asyncapi-supply-chainramimacMiasma: A Supply Chain Attack Targeting Red Hat npm Packages2026-06-01T19:00:00+00:002026-06-01T19:00:00+00:00https://ramimac.me/teampcp-miasmaramimac