The report
A compromised AWS key can make a cloud request look fully authenticated even when its purpose is plainly hostile. In research published November 9, Datadog traced ARTEX-associated sessions that used CloudWatch log searches to hunt for financial-company names, paths and strings resembling credentials.
Evidence of use, not evidence of universal success
One cluster began with a valid long-lived IAM key obtained before the observed log searches. The operator repeatedly called FilterLogEvents, looking for cryptocurrency businesses, hedge funds, invoices, access-key identifiers and passwords. The service accepted the requests under the key’s IAM authority. This is an example of AI-assisted offensive work after credentials were compromised, not proof that ARTEX broke AWS authentication or independently invented an exploit.
Datadog also observed a different AWS route: public Amazon Cognito user pools admitted anonymous registration, issued identities or temporary tokens, and were followed by account-enumeration attempts. The tested downstream calls were denied by the assigned role. These two activity clusters do not form one proven sequence or share a confirmed operator merely because ARTEX-like tooling appeared in both. The Datadog Case separates them, supported by the November 9 investigation.
The ARTEX platform can use several language-model providers and coordinate workers through a task graph. That flexibility explains why its behavior can leave traces across cloud APIs without one fixed model identity. It does not establish which humans controlled each campaign. Existing reporting on South Korean financial targets and exposed operator logs belongs to a separate ARTEX case, rather than being folded into a fictitious single incident.
A useful cloud hunt starts with the exact caller principal and target stream: repeated FilterLogEvents queries for secret-related patterns, unexpected use of long-lived IAM keys and anonymous Cognito enrollment followed by denied resource reads. Protecting secrets from entering logs also changes the data available to an intruder who holds valid log-read authority. Denied enumeration still needs investigation, but it is not confirmed exfiltration.