Microsoft: China-linked group Storm-0940 used SI agents of the ARTEX framework to breach a ConnectWise application and gained cloud access within hours
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
A ready-made open framework with SI agents let a state-linked group run mass attacks and cut the time to cloud access to hours.
According to Microsoft, the group Storm-0940, which the company describes as aligned with the Chinese state, has since September used ARTEX — an open-source multi-agent penetration-testing framework that works with any SI model — to attack hundreds of organizations across industries, from aerospace and defense to finance and government. Microsoft holds the group responsible for the recently disclosed compromise of the multi-tenant ConnectWise Cloud Backup application: using stolen application credentials, the agents scanned networks, guessed passwords and abused permissions in Microsoft 365 environments without an interactive user sign-in. In several cases less than three hours passed from selecting a target to privileged cloud access. According to The Next Web, sign-in attempts were made against more than 2,250 Microsoft 365 tenants, Huntress confirmed breaches at 162, and the rate reached 2,900 sign-in attempts per minute. Microsoft stresses that no vulnerabilities in its products were used, most of the attacks failed, and the presence of an affected application does not mean data was stolen.
Sources 2