Observed incident

Datadog observes ARTEX searching AWS logs and attempting account discovery

Reported

Published here

What happened

Datadog researchers attributed two patterns of October activity in live AWS accounts to ARTEX. In one, a compromised access key was used to search CloudWatch logs for financial information and credentials. In another, an actor obtained temporary AWS credentials through publicly accessible Cognito signup.

Parties and reporting

Where this happened

Victim location not disclosed. Real organizations or systems were affected or targeted, but the sources do not say where. Explore the world map.

AI tools and systems: ARTEX, AWS CloudWatch Logs, Amazon Cognito, AWS Identity and Access Management

Outcome

The first account recorded searches with the compromised key on multiple occasions, including October 20. In the October 26–27 Cognito activity, the permissions assigned to the temporary credentials blocked all subsequent attempts to list cloud resources.

Operating lesson

Review unusual log searches by long-lived keys and check what newly registered Cognito users can read through their assigned roles.

Evidence and limits

Datadog attributes the observed activity to use of the ARTEX framework. Its telemetry does not establish which financial data the actor obtained or identify the victims. The report’s separate count of exposed ARTEX consoles measures infrastructure.

Sources