State-linked Chinese hacking group Storm-0940 leveraged the ARTEX framework—an AI-powered penetration testing toolkit—to attempt intrusions into over 2,250 Microsoft 365 tenants, following the breach of ConnectWise Cloud Backup. The attackers abused stolen credentials tied to applications with pre-approved permissions, enabling access without users entering passwords. While not every attempt succeeded, the scale and speed of operations have raised alarms. The information comes from Microsoft’s technical investigation and independent analysis by Zscaler.
How ARTEX Fueled the Attack
Between October 10 and 14, Storm-0940 launched high-volume failed login attempts, targeting 327 accounts across eight organizations. Although more than 151,000 sign-in failures were observed, Microsoft confirmed none of the password-spray efforts during that period resulted in successful authentication. ARTEX was used for credential scanning, OAuth app misuse, and monitoring tenants via Microsoft Graph, including modifying application credentials and roles.
Crucially, attackers used credentials from applications already trusted by customers, bypassing interactive login requirements entirely. They focused on compromising ConnectWise application identities and granting themselves access—even after the original ConnectWise connection was shut off—by exploiting other apps or services that retained elevated permissions. In some cases, privilege escalation and access to sensitive cloud assets were achieved in under three hours.
ARTEX’s AI-Backed Toolkit and Workflow
Zscaler’s investigation uncovered that Storm-0940 augmented ARTEX with multiple AI workspaces—like Claude Code, Codex—and layered tools like nmap, sqlmap, nuclei, and Android app analyzers into its operations. Tasks are broken down, workflows automated, and findings saved across sessions for follow-ups. Tools are configured to assume permissions, reducing human oversight. Prompts focused on harvesting personal data, payment info, and transaction records. Although discussions of selling stolen records surfaced, there’s no confirmed proof of any such illicit trade.
Indicators and Defensive Measures
Microsoft has shared several indicators of compromise: IPs tied to service-principal activity, specific application IDs related to ConnectWise apps, and user-agents connected to automated toolkits. Defenders are urged to review any apps with granted permissions, scan for unexpected role changes, monitor Microsoft Graph traffic and distant service-principal sign-ins, and preserve any evidence before removing compromised apps. Microsoft stressed the activity exploited misused credentials and permissions—not vulnerabilities in Microsoft’s own systems.
This incident builds on earlier incidents in South Korea where ARTEX was similarly used across sectors and regions.
Why this matters: Storm-0940’s use of ARTEX reflects a troubling evolution in how AI tooling is integrated into threat actor toolkits. The combination of automated workflows, stolen yet “trusted” credentials, and AI-assisted task orchestration means defenders face faster, more stealthy attacks. Going forward, security teams must scrutinize every integration and consent grant, not just obvious login routes. Monitoring non-interactive app permissions and tightening guardrails around OAuth and Microsoft Graph will be essential in turning back efforts like this.
