A sophisticated threat actor linked to China has begun weaponizing an open-source artificial intelligence framework to automate large-scale cyberattacks against enterprise software infrastructure. According to findings published by Microsoft, the group known as Storm-0940 has utilized the Artex penetration testing tool to accelerate intrusion campaigns targeting environments managed through ConnectWise.
Automating Machine-Speed Exploits
Active since at least 2021, Storm-0940 has historically relied on manual tactics such as credential stuffing, password spraying, and exploiting vulnerable internet-facing applications across multiple global sectors. However, telemetry captured by security researchers indicates a sharp escalation in operational tempo starting in early September. By integrating the Artex framework into their kill chain, the attackers shifted from human-paced operations to high-speed automation.
In mid-October campaigns directed at ConnectWise customers, Microsoft observed the threat actor executing reconnaissance and brute-force routines at rates exceeding 2,900 attempts per minute. The automated tooling enabled the group to rapidly process hundreds of accounts across multiple organizations, culminating in unauthorized access to numerous Microsoft 365 and Entra tenants through compromised application credentials.
Deep System Access and Persistence
Once initial authentication was achieved using the identities of impacted ConnectWise cloud applications, the artificial intelligence agents directed by the threat group progressed beyond basic reconnaissance. Security telemetry shows the automated workflows executed directory operations, interacted with Microsoft Graph, and modified application credentials to establish persistent access. By altering these credentials, the actors ensured continued entry points even after administrators moved to remediate the initial application vulnerabilities.
The scale of the automated activity overwhelmed standard logging mechanisms in many instances, with telemetry recording over 151,000 failed logon events alongside successful authentications. In response to the wave of compromises, ConnectWise suspended several cloud services, including Cloud Backup, SaaS Security, and Cloud Management, while industry partners like Huntress and Zscaler issued technical advisories outlining the threat actor infrastructure and configuration scripts.
Widespread Sector Exposure
Investigations by cybersecurity firms reveal that the campaign is not limited to a single industry. Since September, the AI-assisted infrastructure has targeted hundreds of entities spanning aerospace, automotive, chemicals, defense, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, and technology, alongside various non-profits and think tanks.
- Organizations are advised to audit service principal sign-ins alongside Microsoft Graph activity.
- Security teams should meticulously review directory modifications and privilege changes.
- Enterprises must correlate suspicious authentication events with authorized administrative actions.