FBI FLASH: Defending Against ARTEX Autonomous Intrusions

About this course

This course teaches the FBI FLASH FLASH-20261113-001, "Threat Overview of ARTEX Autonomous Penetration Testing Framework", published by the Federal Bureau of Investigation on 13 November 2026 and marked TLP:CLEAR. The FBI reports that ARTEX, an open-source, LLM-driven agentic framework, has been weaponized by a variety of malicious cyber actors to automate intrusions at machine speed, with some intrusions reaching privileged access in under three hours. The course turns the FLASH's techniques, indicators and recommendations into defensive work: an attack surface inventory, identity and cloud hardening, detections, and an evidence-first response and reporting plan. Every fact about ARTEX comes from the FLASH; technique names come from MITRE ATT&CK; vendor documentation is linked only for the mechanics of the controls the FBI recommends. ibl.ai wrote this course; the FBI did not write, review or endorse it, and the FBI provides the FLASH with no guarantees or warranties. The course never explains how to operate ARTEX and never links to copies of it.

What you will be able to do

1. Explain what the FBI's FLASH-20261113-001 reports about ARTEX, its five observed capabilities, the compressed detection window and the two campaigns it names, using only the FLASH's facts and figures.
2. Map observed ARTEX activity to the FLASH's MITRE ATT&CK phases and technique IDs, and turn the table into a phase-by-phase exposure checklist with owners and evidence sources.
3. Reduce the external attack surface the FBI describes: inventory peripheral internet-facing applications and restrict administration and publishing paths such as Kudu/SCM, basic publishing authentication and public IP allocation.
4. Harden identity as the FBI recommends by reviewing service principal sign-ins, Entra audit records, multi-tenant permissions and consent grants by application ID, and detect credential additions and privilege assignments.
5. Strengthen applications and detect ARTEX behavior with guardrails, sequential enumeration detection, secrets scanning and a detection rule set, and vet the FBI's indicators before acting on them.
6. Respond in the FBI's order (preserve, contain, then remove), prepare the information the FBI asks victims to report, and assemble an ARTEX readiness plan for one organization.

Who this course is for

Roles: security engineers, detection and incident response teams, cloud and identity administrators, application security teams and the security leaders who set priorities.

Organizations: any sector, and especially those the FBI singles out: organizations operating internet-exposed applications, self-service portals, cloud infrastructure and partner or supplier systems. The examples use a fictional logistics company.

Before you start: familiarity with identity, cloud and log concepts, and comfort running a Python script from a terminal. The labs need Python 3.9 or later and nothing else; all lab data is synthetic and generated by the labs themselves.

Format

Time: about 8 to 10 hours, self-paced. Level: intermediate. Hands-on: five local labs over synthetic data (service principal sign-in review, Entra audit review, sequential enumeration detection, secrets scanning, and vetting the FBI indicators against proxy logs), with an AI tutor that coaches each step from the output you paste.

Structure: a Start here section, four content sections of readings, worked examples, templates and labs, each ending in an AI assessment, and a capstone in which you write an ARTEX readiness plan for one organization, followed by a reading list.

Grading: the four section AI assessments count for 60 percent of the grade and the capstone assessment for 40 percent. The pass mark is 70 percent.

Currency

Last verified 2026-11-14 against the FBI FLASH-20261113-001 of 13 November 2026, MITRE ATT&CK technique pages, and the Microsoft and AWS documentation the units link.

This threat is changing quickly. The FBI may update or supersede the FLASH, the FBI reports that ARTEX keeps spreading through forks and copies, and vendor documentation changes. Check ic3.gov for the current advisory before relying on any page or template, and test only systems you own or are authorized in writing to test. This course is training, not a security assessment of your systems.