Microsoft says China-aligned Storm-0940 used the ARTEX AI agent framework after the ConnectWise breach, trying to sign in to more than 2,250 tenants

In a Security Blog post on 21 October, Microsoft Threat Intelligence said it “assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise” of a multi-tenant application. Microsoft describes Storm-0940 as a China-state aligned actor active since 2021. Microsoft says the group used ARTEX, an open-source penetration-testing framework of AI agents that can use any AI model.

“Following the unauthorized access, Storm-0940 used ARTEX to attempt to sign-in to more than 2,250 tenants,” Microsoft says. It says most of the targeting was not successful, but reports multiple instances where the time from first targeting to privileged access was less than three hours. In some victims' environments the agents changed application credentials and privileged roles. Microsoft also describes a separate password spray from 10 to 14 October against 327 accounts at eight organisations, in which its telemetry captured more than 151,000 failed logon events.

Microsoft says the activity did not come from a compromise of, or a flaw in, its own systems. ConnectWise published an initial advisory on 16 October, the post says.

• Confirmed Microsoft assesses that Storm-0940 was behind the ConnectWise supply-chain compromise and used ARTEX to attempt to sign in to more than 2,250 tenants. Microsoft Security Blog
• Claimed Microsoft says that in multiple instances the time from first targeting to privileged access was less than three hours. Microsoft Security Blog