A sophisticated, China-linked threat actor known as Storm-0940 has been actively weaponizing an open-source artificial intelligence penetration testing framework called Artex to automate a sweeping cyberattack campaign. According to recent intelligence reports released by Microsoft and other major cybersecurity firms, the advanced persistent threat (APT) group has utilized the framework to orchestrate high-speed intrusions targeting hundreds of organizations globally, including a significant supply chain compromise involving ConnectWise products.<\/p>\n
Tracked by security researchers since at least 2021, Storm-0940 has historically built its operational reputation on traditional yet effective tactics. The threat group frequently relies on password spraying techniques and the exploitation of vulnerable, internet-facing applications to breach corporate defenses. Operating across multiple critical sectors, the APT has consistently demonstrated an ability to adapt its methodology to match evolving technological landscapes.<\/p>\n
The current wave of automated attacks began gaining visibility in early September, when security analysts observed the threat actor abusing the Artex framework to accelerate its intrusion workflows. Prior intelligence gathering by prominent cybersecurity organizations\u2014including CrowdStrike, Zscaler, and Recorded Future\u2014initially linked this emerging, AI-powered activity to targeted intrusions directed against South Korean financial institutions. These early operations provided the cybersecurity community with the first concrete warning signs that threat actors were beginning to successfully operationalize agentic AI frameworks for large-scale offensive operations.<\/p>\n
The scope of the campaign widened dramatically in mid-October, when Microsoft reported that Storm-0940 leveraged Artex to automate intrusions directly into customer environments associated with ConnectWise. The rapid escalation and severity of the threat compelled ConnectWise to take immediate defensive action, suspending several core cloud services, including Cloud Backup, SaaS Security, and Cloud Management, to stem the flow of unauthorized access.<\/p>\n
Concurrently, cybersecurity firm Huntress observed threat actors successfully utilizing compromised ConnectWise application credentials to pierce the perimeters of hundreds of Microsoft 365 tenants. The automated nature of the breach allowed the attackers to sweep across more than 300 Entra tenants in a remarkably short window of time. <\/p>\n
According to technical breakdowns provided by Microsoft, the threat group integrated Artex into its command-and-control infrastructure to drastically accelerate reconnaissance, password spraying, and OAuth application abuse. Operating at unprecedented speeds, the automated tooling struck more than 300 accounts spread across eight distinct organizations at a blistering pace of over 2,900 login attempts per minute.<\/p>\n
Following the initial unauthorized access, telemetry data shows that Storm-0940 utilized the AI framework to attempt sign-ins to more than 2,250 separate corporate tenants. While OAuth application abuse has long been a staple component of Storm-0940\u2019s traditional cyber espionage and extortion toolset, the integration of Artex fundamentally shifted the dynamic by executing these malicious workflows at machine speed. <\/p>\n
Microsoft\u2019s threat intelligence division captured over 151,000 failed logon events directly associated with the aggressive campaign. However, the automated onslaught also registered numerous successful authentications into customer cloud environments by leveraging the verified identities of multiple ConnectWise cloud applications. <\/p>\n
In several of these compromised environments, the autonomous AI agents\u2014acting directly on behalf of the human threat actors\u2014progressed far beyond simple authentication. Microsoft\u2019s analysis reveals that the AI tooling successfully interacted with Microsoft Graph and performed complex directory operations. These actions included extensive internal reconnaissance, modifications to application credentials designed to establish persistent access, and alterations involving user identities, security groups, and highly privileged administrative roles.<\/p>\n
By systematically changing application credentials within the compromised tenants, the attackers engineered a method of maintaining persistent access to victim environments even after the underlying vulnerable applications had been patched, remediated, or temporarily suspended. Microsoft has issued urgent warnings to the cybersecurity community regarding this persistence mechanism, emphasizing that traditional remediation steps alone will not be sufficient if threat actors have already manipulated application credentials and service principals.<\/p>\n
To counter these sophisticated tactics, Microsoft advises organizations to thoroughly examine service principal sign-ins and cross-reference them with subsequent Microsoft Graph activity, directory alterations, and internal resource access. Security teams must carefully correlate these suspicious events with authorized administrative actions to distinguish between legitimate IT management and malicious AI-driven manipulation.<\/p>\n
The scale of the Storm-0940 campaign extends far beyond the technology and software sectors. Since the beginning of September, intelligence indicators show that the threat actor has deployed Artex in automated attacks against hundreds of organizations spanning a vast array of industries. Targeted sectors include aerospace, automotive, chemicals, defense, energy, financial services, government agencies, legal practices, manufacturing, media, military entities, semiconductors, software development, and general technology firms. Additionally, the automated sweeps have targeted non-profit organizations and policy think tanks.<\/p>\n
In tandem with Microsoft’s disclosures, cybersecurity firm Zscaler published a comprehensive technical deep-dive into Storm-0940\u2019s AI-assisted offensive operations. The report provides granular details regarding how the threat actor configures and deploys the Artex framework, including synchronization scripts, historical logs of Claude Code prompts, and advanced network routing tools used to obscure the origin of the malicious traffic. As threat actors continue to experiment with and deploy agentic AI frameworks for offensive cyber operations, security researchers and enterprise defenders face an increasingly automated threat landscape where speed and machine-scale execution demand equally advanced, automated defensive countermeasures.<\/p>\n","protected":false},"excerpt":{"rendered":"
A sophisticated, China-linked threat actor known as Storm-0940 has been actively weaponizing an open-source artificial intelligence penetration testing framework called Artex to automate a sweeping cyberattack campaign. According to recent intelligence reports released by Microsoft and other major cybersecurity firms, the advanced persistent threat (APT) group has utilized the framework to orchestrate high-speed intrusions targeting<\/p>\n","protected":false},"author":25,"featured_media":2519,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[313],"tags":[2052,2054,423,323,368,178,2055,321,56,320,2068,216,2069,2053,670,2070,77,322],"class_list":["post-2520","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incident-response-forensics","tag-actor","tag-artex","tag-attacks","tag-blockchain-analysis","tag-chain","tag-china","tag-connectwise","tag-forensics","tag-framework","tag-incident-response","tag-leverages","tag-linked","tag-penetration","tag-storm","tag-supply","tag-testing","tag-threat","tag-tracking"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2520","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2520"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2520\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/2519"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2520"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2520"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2520"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}