Post

@threatintel.microsoft.com

The China state-aligned threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. msft.it/63321aakGX

msft.itAI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | Microsoft Security BlogStorm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.

21/10/26, 6:33 pm7 reposts11 likes

Global Threat Signal

@globalthreatsignal.bsky.social

Agentic AI lowering the cost of running a campaign across hundreds of targets at once is the real shift here. Supply chain access through a trusted vendor makes detection even harder.

Microsoft Threat Intelligence

@threatintel.microsoft.com

Microsoft Threat Intelligence assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multitenant application.

Microsoft Threat Intelligence

@threatintel.microsoft.com

Our investigation found that Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in.

Microsoft Threat Intelligence

@threatintel.microsoft.com

AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access.

Microsoft Threat Intelligence

@threatintel.microsoft.com

Read our blog for a detailed analysis and indicators of compromise (IOCs), along with Microsoft Defender detections, protection recommendations, and guidance on investigating service principal sign-ins and unexpected application credential or privilege changes.