Overview
- Microsoft disclosed on Wednesday that the China-aligned group Storm-0940 used the ARTEX AI framework to exploit a ConnectWise Cloud Backup compromise and attack downstream Microsoft 365 environments.
- ARTEX ran autonomous workflows that performed password-spray campaigns, reconnaissance, and OAuth/service-principal abuse, producing spikes as high as about 2,900 sign-in attempts per minute and touching more than 2,250 tenants.
- In some cases attackers moved from initial access to elevated cloud privileges in under three hours, and Microsoft observed attackers modifying credentials and roles to establish persistent, high-level access across diverse sectors.
- ConnectWise said it began investigating unauthorized access on Oct. 16, temporarily shut affected services, and started phased restoration this week while advising customers to keep connections disabled during recovery.
- The incident highlights a growing dual-use risk: ARTEX was open-sourced in July, was linked to earlier South Korea breaches affecting roughly 68,000 people, moved closed-source after misuse, and is now being reused by multiple actors so defenders must audit service-principal permissions and apply Microsoft’s detections.