微软报告称 Storm-0940 用开源 AI 智能体 ARTEX 自动化攻击数百家机构
Microsoft published a new report saying that it has seen cyberattacks carried out by a Chinese state-aligned actor called Storm-0940, which used a Chinese AI ag
微软发布报告称，名为 Storm-0940 的中国国家关联行为体使用开源 AI 智能体 ARTEX 自动化攻击全球数百家不同行业的机构。ARTEX 在 GitHub 上以开源形式发布，将多个 LLM 智能体串联起来，从侦察到数据窃取几乎无需人工介入；它利用 ConnectWise 的 Microsoft 365 备份与管理应用密钥登录，绕过用户登录和 MFA，数起入侵在不到 3 小时内从初始目标达成云特权访问。报告也指出多数攻击尝试失败，其中一次密码喷洒记录 151K+ 次失败且无一成功，仅凭应用登录也不能证明数据被窃取。
推荐理由
AI 评分 74
微软报告披露开源 LLM 智能体 ARTEX 把渗透测试从侦察到窃取数据串成自动化流程，部分入侵在 3 小时内拿到云特权访问。
主题
正文
Microsoft published a new report saying that it has seen cyberattacks carried out by a Chinese state-aligned actor called Storm-0940, which used a Chinese AI agent named Artex to automate attacks aimed at hundreds of organizations worldwide in a broad range of industries.
ARTEX, released on GitHub as open source, chains LLM agents through a penetration test from reconnaissance to data theft with little human input.
The keys belonged to ConnectWise’s Microsoft 365 backup and management apps, already trusted with wide access, so signing in skipped user logins and MFA.
Several ARTEX-driven intrusions went from first targeting to privileged cloud access in under 3 hours.
Inside some tenants, the agents queried Microsoft Graph, added credentials to other apps and had a ConnectWise app grant itself Global Administrator.
Most targeting still failed, including a password spray that logged 151K+ failures without one success, and an app sign-in alone does not prove theft.
OAuth app abuse is old Storm-0940 tradecraft, but ARTEX ran it fast enough to leave defenders little time between alert and revocation.