Datadog examined ARTEX-like AWS control-plane sessions across several live environments in October. Every reviewed session began with anonymous S3 probes. In one observed cluster, a previously compromised long-lived IAM access key repeatedly called CloudWatch FilterLogEvents, searching for names of cryptocurrency businesses, hedge funds, invoices, paths and…
Inspect the ClaimsCase · DiggingBeagle record
ARTEX-associated AWS sessions searched CloudWatch for financial data and credential material
Datadog observed ARTEX-associated use of compromised AWS keys for repeated log searches and a separate public Cognito enrollment path with denied account-enumeration calls.
Public disclosure: Nov 9, 2026
Scope
AWS environments identified by Datadog, mainly October 2026. Treat the long-term IAM-key and public-Cognito observations as different access paths rather than consecutive steps in a single verified intrusion.
Assessment profile
Assessment method- Setting
- production
- Exploitation
- observed live
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- WITH AI
Basis and provenance
Desk assessment of cited firsthand report and scope limits; quantitative denominators describe only the reporter's stated sample. No independent live exploitation or universal impact is inferred.
Assessed Nov 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-R236-ARTEX-DATADOG-AWS-CLOUDWATCH-01 · CLM-R236-ARTEX-DATADOG-AWS-CLOUDWATCH-02 · Datadog Security Labs: On the hunt for ARTEX in AWS environments
At a glance
Log systems become credential search targets after a cloud foothold. The same framework signature appearing across tenants makes defensive correlation useful but does not establish one command authority or one group of victims.
Read the implicationsThe public account does not name every victim, establish financial theft, demonstrate that model reasoning chose each API call, or connect these clusters to DIVD, South Korean finance or WorkOS operators. Whether the compromised IAM credentials were acquired through another ARTEX-led operation or an unrelated prior compromise; Datadog does not establish…
Limits and uncertaintyFull account
Datadog examined ARTEX-like AWS control-plane sessions across several live environments in October. Every reviewed session began with anonymous S3 probes. In one observed cluster, a previously compromised long-lived IAM access key repeatedly called CloudWatch FilterLogEvents, searching for names of cryptocurrency businesses, hedge funds, invoices, paths and credential strings such as AKIA keys. The valid key existed before that log-search step; ARTEX was not demonstrated breaking IAM cryptography.
Datadog also distinguished a separate path through publicly accessible Cognito user pools: anonymous registration yielded tokens and temporary cloud credentials, followed by resource-enumeration attempts that failed because the assumed role lacked permissions. The latter denied calls are not evidence of a successful cloud-data extraction. The report provides request patterns and console indicators, not a confirmed common actor tying every ARTEX incident together.
AWS environments identified by Datadog, mainly October 2026. Treat the long-term IAM-key and public-Cognito observations as different access paths rather than consecutive steps in a single verified intrusion.
The public account does not name every victim, establish financial theft, demonstrate that model reasoning chose each API call, or connect these clusters to DIVD, South Korean finance or WorkOS operators.
Datadog's first AWS pattern starts after valid long-lived IAM keys were compromised. ARTEX-associated activity then searched CloudWatch using FilterLogEvents, repeatedly requesting up to 1,000 results and matching terms associated with investment firms, invoices, object locations and credentials. CloudWatch is an attractive secondary collection point because ordinary operational logs can echo secrets or identifiers even when the original business dataset is better protected.
The public Cognito pattern has a different prerequisite: an open user-pool registration flow let the actor obtain tokens and temporary credentials. The subsequent service enumeration attempts in Datadog's sample were denied by IAM, so this path did not demonstrate access to private AWS datasets. Cross-case correlation requires exact credential and session linkage; a recurring ARTEX control-panel logo is insufficient.
Mechanism and trust boundary
- 01
Probe public AWS surfaces
Reviewed sessions began with anonymous S3 read requests, which alone did not grant authority.
Boundary: internet / public AWS endpoints
- 02
Use preexisting IAM foothold
One cluster used a compromised access key to search CloudWatch logs repeatedly.
Boundary: compromised IAM identity / protected log data
- 03
Attempt alternate Cognito enrollment
Another cluster signed up and tested temporary credentials; restrictions denied subsequent enumeration.
Boundary: unauthenticated signup / cloud role permissions
Claims & evidence
CLM-R236-ARTEX-DATADOG-AWS-CLOUDWATCH-01Datadog observed ARTEX-attributed live AWS activity using compromised long-lived IAM credentials to call CloudWatch FilterLogEvents for financial-company and secret-related terms.supported
Basis: reported finding
- supportsDatadog Security Labs: On the hunt for ARTEX in AWS environmentsprimary disclosure
ARTEX sightings in AWS environments; Activity cluster 1
CLM-R236-ARTEX-DATADOG-AWS-CLOUDWATCH-02Datadog separately observed ARTEX-attributed public Cognito enrollment and attempted AWS enumeration, with denied read operations under the assigned role.supported
Basis: reported finding
- supportsDatadog Security Labs: On the hunt for ARTEX in AWS environmentsprimary disclosure
ARTEX sightings in AWS environments; Cognito user-pool cluster
Implications
Log systems become credential search targets after a cloud foothold. The same framework signature appearing across tenants makes defensive correlation useful but does not establish one command authority or one group of victims.
Controls and mitigations
- Investigate anomalous CloudTrail FilterLogEvents and short repeated queries for financial labels, secret patterns and object paths.
- Rotate exposed long-term IAM keys and limit log-reading rights to the minimum streams; do not treat an authenticated key as evidence of authorized use.
- Tightly scope Cognito unauthenticated signup roles and test that temporary tokens cannot enumerate resource APIs.
- Investigate sensitive `FilterLogEvents` query strings and response volumes under unexpected long-lived IAM identities, while controlling which secrets appear in CloudWatch in the first place.
Unknowns and contradictions
- The public account does not name every victim, establish financial theft, demonstrate that model reasoning chose each API call, or connect these clusters to DIVD, South Korean finance or WorkOS operators.
- Whether the compromised IAM credentials were acquired through another ARTEX-led operation or an unrelated prior compromise; Datadog does not establish that origin.
Sources and citation
Material revision history
- Nov 11, 2026 · Published version · first publication · revision 238