A China-linked advanced persistent threat (APT) group has been actively weaponizing an open-source artificial intelligence penetration testing framework known as Artex to automate a sweeping wave of cyberattacks, according to new intelligence shared by Microsoft. The threat actor, tracked by Microsoft\u2019s threat intelligence teams as Storm-0940, has leveraged the framework to orchestrate a high-speed hacking campaign targeting ConnectWise customers across multiple critical sectors, prompting urgent security responses and service suspensions from the technology provider.<\/p>\n
Active since at least 2021, Storm-0940 has historically built its operational reputation on conventional techniques such as password spraying and the exploitation of vulnerabilities in internet-facing applications. The group has consistently demonstrated a wide-ranging operational scope, successfully infiltrating organizations across a diverse array of industries. However, the group’s adoption of advanced agentic AI tooling marks a significant escalation in its operational capabilities, transitioning manual or semi-automated tactics into high-speed, machine-driven intrusions.<\/p>\n
The shift toward AI-assisted operations became apparent in early September, when cybersecurity firms including CrowdStrike, Zscaler, and Recorded Future observed threat actors abusing Artex to launch automated attacks targeting financial institutions in South Korea. These initial incidents served as an early warning of a broader operational pivot by the APT, signaling that the framework was being integrated into active campaigns on an international scale.<\/p>\n
Building upon those regional observations, Microsoft reported that Storm-0940 deployed Artex in mid-October to automate intrusions into the environments of ConnectWise customers. The severity of the campaign and the speed of the automated incursions forced ConnectWise to take immediate defensive action, resulting in the temporary suspension of several core cloud services, including Cloud Backup, SaaS Security, and Cloud Management, to stem the flow of unauthorized access.<\/p>\n
During the height of the mid-October surge, cybersecurity firm Huntress observed the attackers leveraging compromised ConnectWise application credentials to gain unauthorized access to hundreds of Microsoft 365 tenants. This included more than 300 Entra tenants, demonstrating the extensive scale of the supply chain compromise.<\/p>\n
According to Microsoft’s telemetry and analysis, Storm-0940 relied heavily on the Artex framework to massively accelerate reconnaissance, password spraying, and OAuth application abuse. The automated infrastructure allowed the threat actor to strike over 300 accounts across eight distinct organizations at an astonishing pace, logging more than 2,900 access attempts per minute.<\/p>\n
Following the initial unauthorized access, the threat actor utilized Artex to attempt sign-ins to more than 2,250 separate tenants. While OAuth application abuse is a well-documented component of Storm-0940\u2019s traditional toolset, the integration of Artex transformed the attack dynamic, enabling the group to execute these malicious routines at machine speed. <\/p>\n
Microsoft\u2019s security monitoring systems captured more than 151,000 failed logon events associated with the broader campaign. Alongside these rejections, researchers observed numerous instances of successful authentication into customer environments achieved through the stolen identities of multiple ConnectWise cloud applications.<\/p>\n
In several of these breached environments, the automated AI agents operating on behalf of the threat actor progressed far beyond simple authentication. Microsoft explained that the agents successfully navigated into Microsoft Graph and directory operations. This advanced phase of the intrusion included conducting deep reconnaissance, modifying application credentials to establish persistent access, and executing unauthorized changes involving identities, groups, and privileged user roles.<\/p>\n
By systematically altering application credentials, the attackers ensured that they maintained persistent access to the victims\u2019 environments, retaining their footholds even after the initially affected applications were identified and remediated by administrators. Microsoft warned that this persistent capability makes cleanup significantly more complex for affected enterprises.<\/p>\n
To combat these advanced threats, the tech giant advised organizations to thoroughly examine service principal sign-ins and correlate them with subsequent Microsoft Graph activity, directory changes, and resource access logs, contrasting these metrics against authorized administrative activity to spot anomalies.<\/p>\n
The operational footprint of Storm-0940\u2019s AI-assisted campaign extends far beyond the financial sector. According to Microsoft\u2019s tracking, since early September, the threat actor has used Artex in automated attacks against hundreds of organizations spanning a wide cross-section of the global economy. Targeted industries include aerospace, automotive, chemicals, defense, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, and technology sectors, as well as non-profit organizations and policy think tanks.<\/p>\n
The scale and sophistication of the campaign have drawn intense scrutiny from the global cybersecurity community. Zscaler published a detailed technical deep-dive into Storm-0940\u2019s AI-assisted operations, providing granular insights into how the threat actor configures Artex, utilizes synchronization scripts, deploys network routing tools, and manages Claude Code prompt histories during its attacks.<\/p>\n","protected":false},"excerpt":{"rendered":"
A China-linked advanced persistent threat (APT) group has been actively weaponizing an open-source artificial intelligence penetration testing framework known as Artex to automate a sweeping wave of cyberattacks, according to new intelligence shared by Microsoft. The threat actor, tracked by Microsoft\u2019s threat intelligence teams as Storm-0940, has leveraged the framework to orchestrate a high-speed hacking<\/p>\n","protected":false},"author":26,"featured_media":2555,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[313],"tags":[2052,2054,2081,323,178,2055,241,321,56,320,216,748,749,2053,77,322,440],"class_list":["post-2556","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-incident-response-forensics","tag-actor","tag-artex","tag-automate","tag-blockchain-analysis","tag-china","tag-connectwise","tag-cyberattacks","tag-forensics","tag-framework","tag-incident-response","tag-linked","tag-open","tag-source","tag-storm","tag-threat","tag-tracking","tag-uses"],"_links":{"self":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2556","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/users\/26"}],"replies":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2556"}],"version-history":[{"count":0,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/posts\/2556\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=\/wp\/v2\/media\/2555"}],"wp:attachment":[{"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2556"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2556"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wyominginvest.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2556"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}