Evidence · DiggingBeagle record
Datadog Security Labs: On the hunt for ARTEX in AWS environments
- Published
- Nov 9, 2026
- Source role
- primary disclosure
Evidence record
Claim-level citations (2)
- supportsARTEX-associated AWS sessions searched CloudWatch for financial data and credential material: Datadog observed ARTEX-attributed live AWS activity using compromised long-lived IAM credentials to call CloudWatch FilterLogEvents for financial-company and secret-related terms.
ARTEX sightings in AWS environments; Activity cluster 1
- supportsARTEX-associated AWS sessions searched CloudWatch for financial data and credential material: Datadog separately observed ARTEX-attributed public Cognito enrollment and attempted AWS enumeration, with denied read operations under the assigned role.
ARTEX sightings in AWS environments; Cognito user-pool cluster