Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Original title: China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
Microsoft says China-linked Storm-0940, active since at least 2021, used the open-source AI penetration-testing framework Artex in mid-October to automate attacks on ConnectWise customers. The actor sprayed passwords and abused OAuth, then in some environments changed application credentials and directory roles for persistence. ConnectWise suspended Cloud Backup, SaaS Security, and Cloud Management. Huntress had seen compromised ConnectWise application credentials used against hundreds of Microsoft 365 tenants, including over 300 Entra tenants.
Unconfirmed: Microsoft attributes the ConnectWise activity to Storm-0940; earlier South Korea links came from other firms.
- More than 2,900 attempts per minute hit over 300 accounts across eight organizations.
- Artex was used to try sign-ins to more than 2,250 tenants.
- Since early September the activity spanned aerospace, defense, energy, finance, government, and other sectors.
- Changing application credentials kept access after the affected application was remediated.
Impact: Persistent cloud access and directory changes in customer tenants
| Product | Affected |
|---|---|
| ConnectWise Cloud Backup, SaaS Security, and Cloud Management | — |
- 1.Correlate service-principal sign-ins with Microsoft Graph, directory changes, and resource access.
- 2.Check for application credential changes that outlast remediation of the original app.
- ATT&CK
- T1110.003 Password SprayingT1528 Steal Application Access TokenT1098 Account ManipulationT1078.004 Valid Accounts: Cloud Accounts
- Vendors
- ConnectWiseMicrosoft
- Threat actors
- Storm-0940
- Organizations
- HuntressCrowdStrikeZscalerRecorded Future
- Countries
- ChinaSouth Korea
From the original article
2 min read at securityweek.com
The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments. The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.