Chinese hacker group Storm-0940 uses its own AI framework ARTEX to launch large-scale attacks and leverages ConnectWise credentials to penetrate corporate clouds

Microsoft released a research report on October 21 attributing large-scale automated attacks using the open-source AI penetration testing framework ARTEX to the China-backed hacking group Storm-0940, saying it has attacked hundreds of organizations worldwide and in some cases gained high-privilege access to corporate cloud environments in less than 3 hours. Microsoft also attributed the ConnectWise Cloud Backup supply chain intrusion to this group; the attackers used stolen application credentials to attempt logins to more than 2,250 Microsoft 365 tenants, and at one point generated more than 200 login records with 4 sets of credentials in less than 4 minutes. Microsoft observed that between October 10 and 14, Storm-0940 conducted password spraying attacks against 327 accounts of 8 organizations, with more than 151,000 cumulative failed logins; nearly 98% of login attempts received account lockout responses, and no successful logins were observed.