Understand this story
Microsoft released a report stating that the China-linked actor Storm-0940 used the open-source AI agent ARTEX to automate attacks against hundreds of organizations across different industries worldwide. The report notes that ARTEX was released as open source on GitHub and chains together multiple LLM agents, requiring almost no human intervention from reconnaissance to data theft; it uses ConnectWise's Microsoft 365 backup and management application keys to log in, bypassing user login and MFA, and in several intrusions it achieved cloud privileged access from the initial target in under 3 hours. The report also notes that most attack attempts failed, including one password spray that logged 151K+ failures with none succeeding, and that application login alone does not prove data was stolen. There are currently no further developments.
AI-generated from public reports
Developments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 22
Rohan Paul
Microsoft report says Storm-0940 used open-source AI agent ARTEX to automate attacks on hundreds of organizations
Microsoft released a report stating that a China-linked actor named Storm-0940 used the open-source AI agent ARTEX to automate attacks on hundreds of organizations across different industries worldwide. ARTEX is released as open source on GitHub and chains together multiple LLM agents, requiring almost no human intervention from reconnaissance to data theft; it logs in using ConnectWise's Microsoft 365 backup and management application key, bypassing user sign-in and MFA, and in several intrusions achieved cloud privileged access from the initial target in under 3 hours. The report also notes that most attack attempts failed, with one password spray recording 151K+ failures and not a single success, and that application sign-in alone does not prove data was stolen.