Microsoft says Storm-0940 used AI-driven ARTEX framework in attacks
Microsoft Threat Intelligence reported that the China state‑aligned hacking group Storm‑0940 leveraged ARTEX, an AI‑driven penetration‑testing framework, to automate a multi‑stage campaign. The research describes an operation from October 10‑14 that targeted 327 accounts using the tool, then moved to a ConnectWise supply‑chain compromise on October 15‑16. ConnectWise publicly acknowledged the…
Key points
- Microsoft ties Storm‑0940 to ARTEX, an AI‑driven framework used in a campaign that hit 327 accounts Oct 10‑14.
- Attackers exploited a ConnectWise supply‑chain breach, abusing OAuth app identities and firing 2,900 sign‑in attempts per minute.
- ARTEX, released July 2026 for legitimate testing, was closed‑source in October 2026 after misuse affecting over 2,250 tenants.
During the ConnectWise phase, the attackers abused OAuth application identities, generating authentication attempts at a rate of 2,900 sign‑ins per minute. Microsoft linked the activity to abuse affecting more than 2,250 tenants. Earlier misuse of ARTEX was tied to data breaches that exposed roughly 68,000 individuals at South Korean financial institutions. ARTEX was released in July 2026 for legitimate security testing and was made closed‑source in October 2026 after the reported misuse.
Microsoft’s guidance advises security teams to audit third‑party apps with OAuth permissions, monitor service‑principal sign‑ins for unusual volume, and treat sudden bursts of authentication attempts as an alarm. The three‑hour breach window highlighted by the report underscores how AI‑driven tools can compress attack timelines beyond traditional defensive response times.
Microsoft links Storm-0940 to AI-driven attacks using ARTEX framework
cryptobriefing.com · 21 October 2026
Loading the full article…
This text was published by cryptobriefing.com and written by Diego Almada Lopez. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
Coverage and discussion
10sources- Microsoft says China-aligned hackers used AI agents in ConnectWise attackPress · thenextweb.com ·
- Microsoft says China-linked hackers used AI penetration testing tool ARTEX to compromise ConnectWise as part of a campaign targeting hundreds of organizationsPress · reuters.com ·
- AI-Powered hackers, 2,900 attempts a minute: Microsoft blames China-linked group for AI-assisted ConnectWise cyberattackPress · businesstoday.in ·
- Microsoft: Chinese State Actor Used AI to Compromise ConnectWise TenantsPress · infosecurity-magazine.com ·
- China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantsPress · csoonline.com ·
- China-Linked Hacker Used Agentic AI to Reach Cloud Privileges in Under 3 Hours, Microsoft SaysPress · ibtimes.sg ·
- Chinese-linked hackers used AI in ConnectWise breach: MicrosoftPress · aa.com.tr ·
- China-Linked Hackers Use ARTEX AI Agents to Abuse ConnectWise Supply Chain AttackPress · thehackernews.com ·
- Chinese-linked hackers compromise ConnectWise, target hundreds in global attack: MicrosoftPress · straitstimes.com ·
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Agents & Tools
All →- Nvidia, HPE and Schneider Electric launch industrial AI agents at the edge · 1 src
- 1Password lets AI agents sign in without seeing passwords · 1 src
- Amazon blocks Meta’s Muse shopping agent as retailers grow wary · 1 src
- Google open-sources Harness² for self-improving AI agents without retraining · 2 src
- Symantec reports AI agent hijacking language models to launch self-sustaining attacks · 1 src
Comments
via GitHub Discussions