Microsoft chorshanba kuni e'lon qildiki, Storm-0940 deb nomlangan Xitoy davlatiga aloqador subyekt yaqinda ConnectWise Cloud Backup ilovasining ta'minot zanjiri buzilishiga sabab bo'lgan.
Hodisa davomida Storm-0940 ARTEX'dan foydalangan — bu Go tilida yozilgan agentik AI penetratsion testlash tizimi bo'lib, Janubiy Koreya moliyaviy muassasalariga qaratilgan kiberhujumlarda suiiste'mol qilingandan so'ng yopiq manbaga aylantirilgan. U skanerlash va razvedka, parol purkash (password spraying) va pastki qurbonlarda OAuth ilova suiiste'molini tezlashtirish uchun ishlatilgan.
Texnologiya giganti aytishicha, tahdid subyekti AI vositasidan "mashina tezligida" foydalanib, 2026-yil sentyabridan beri dunyo bo'ylab yuzlab tashkilotlarga qaratilgan hujumlarni avtomatlashtirgan. Hujumlar keng sohalarni qamrab olgan: aerokosmik va mudofaa, avtomobilsozlik, kimyo, energetika, moliyaviy xizmatlar, hukumat, huquq, ishlab chiqarish, ommaviy axborot vositalari, harbiy, yarimo'tkazgichlar, dasturiy ta'minot, texnologiya, shuningdek, tadqiqot markazlari va notijorat tashkilotlar.
"Storm-0940'ning ARTEX'dan foydalanishi allaqachon ruxsat berilgan ilovalar orqali maqsadli muhitlarga autentifikatsiya qilish uchun buzilgan ilova suiiste'molining tezligini oshirdi, bu tahdid subyektiga interaktiv foydalanuvchi kirishisiz ishlash imkonini berdi," — dedi Microsoft.
"AI tezlashtirilgan keyingi faoliyat razvedka, ilova ma'lumotlarini o'zgartirish va kengaytirilgan yoki doimiy kirish imkonini beradigan imtiyozlarni o'zgartirish urinishlarini o'z ichiga oldi."
Storm-0940 birinchi marta Microsoft tomonidan 2024-yil noyabrda batafsil yoritilgan bo'lib, tahdid subyekti Quad7 (aka CovertNetwork-1658) deb nomlangan botnetdan foydalanib, yuqori darajada yashirin parol purkash hujumlarini amalga oshirayotgani aniqlangan. Tahdid subyektining kamida 2021-yildan beri faol ekani baholangan.
Dushman shuningdek, dastlabki kirish uchun internetga ochiq ilovalardan foydalanadi, so'ngra buzilgan hisoblar orqali maqsadli muhitlarda harakatlanadi. Shuningdek, bulut infratuzilmasidagi mavjud OAuth ilovalariga ma'lumot qo'shish orqali doimiy kirishni ta'minlash kuzatilgan, bu Microsoft 365 resurslariga kirishni kafolatlaydi.
Microsoft ma'lumotiga ko'ra, ARTEX bilan boshqariladigan ushbu hujumlarning bir qismi dushmanga tashkilotning bulut infratuzilmasiga imtiyozli kirish olishiga olib kelgan, jumladan, dastlabki hujumdan imtiyozli kirishgacha bo'lgan vaqt 3 soatdan kam bo'lgan bir nechta holatlar ham kuzatilgan.
ConnectWise hodisasi holatida Storm-0940 ARTEX'dan foydalanib, 2 250 dan ortiq ijarachiga (tenant) kirishga uringan, daqiqasiga 2 900 kirish urinishlari tezligida — bu kompaniya aytishicha, himoyachilarga aniqlash va javob berish uchun qisqa vaqt qoldiradi.
"2026-yil 10-oktabrdan 14-oktabrgacha Storm-0940 infratuzilmasi 144.172.64[.]99 manzilida sakkizta tashkilot bo'yicha 327 ta hisobni nishonga olgan avtomatlashtirilgan o'zaro ijarachi parol purkash kampaniyasini o'tkazdi, Microsoft 365 va Exchange Online'ga kirish maqsadida," — dedi Microsoft.
Ushbu davrda Microsoft 151 000 dan ortiq muvaffaqiyatsiz kirish hodisalarini qayd etgan. Faoliyat 11-oktabrda daqiqasiga 2 900 ta muvaffaqiyatsizlik bilan avj olgan, natijada bir kunda 111 000 dan ortiq muvaffaqiyatsizlik qayd etilgan. Ulardan 48 ta hisob 1 000 dan ortiq muvaffaqiyatsizlik olgan. Hech qanday muvaffaqiyatli autentifikatsiya, token berilishi, Graph chaqiruvi yoki katalog o'zgarishi aniqlanmagan, deb ta'kidlangan.
Bu 2026-yil 15-oktabrda o'zgargan, o'shanda AI agentlari bir nechta ConnectWise bulut ilovalarining identifikatorlariga kirish olgan va ularni mijoz muhitlariga autentifikatsiya qilish uchun ishlata boshlagan.
"Bundan tashqari, bir nechta ConnectWise bulut ilovalarining identifikatorlarini nazoratga olgandan so'ng, tahdid subyekti nomidan ishlaydigan AI agentlari o'sha IP diapazonidan foydalanib, ushbu o'g'irlangan ilova ma'lumotlari orqali olingan noqonuniy kirishdan foydalanib, mijoz muhitlariga autentifikatsiya qilishni davom ettirgan, bu ilovalarning ijarachi ichida allaqachon o'rnatilgan ishonchidan foydalanish imkonini bergan," — deb qo'shdi texnologiya giganti.
Ba'zi hollarda AI agentlari autentifikatsiyadan tashqari Microsoft Graph va katalog operatsiyalariga o'tgan deb baholangan. Bu razvedka, doimiy kirishni ta'minlash uchun ilova ma'lumotlarini o'zgartirish va identifikatorlar, guruhlar va imtiyozli rollar bilan bog'liq o'zgarishlarni o'z ichiga olgan.
TAG-217 hujum zanjiri | Manba: Zscaler
"Storm-0940 bilan bog'liq agentlar tomonidan maqsadli qurbonlar muhitida qilingan ilova ma'lumotlarini o'zgartirish boshqa identifikatorlar, ma'lumotlar va bulut xizmatlari orqali doimiy kirish imkonini berishi mumkin," — dedi Microsoft. "Ushbu o'zgarishlar asl buzilgan ilova bartaraf etilgandan keyin ham orqa eshik sifatida faol qolishi mumkin."
Storm-0940 ARTEX'ga tayanadigan yagona xaker guruhi emas. Microsoft aytishicha, turli geografik hududlardagi tahdid subyektlari o'z operatsiyalarida ushbu tizimdan foydalanayotgani kuzatilgan.
Recorded Future Insikt Group, Janubiy Koreya moliyaviy muassasalariga qaratilgan hujumlar ortidagi tahdid klasterini TAG-217 nomi bilan kuzatayotgan, 2026-yil 17-avgustdan boshlab xaker guruhiga bog'liq faoliyatni aniqlaganini aytdi, o'shanda u "kompyuterlarga masofadan kirishni saqlash uchun mo'ljallangan infratuzilmani sinovdan o'tkazgan va internet skanerlashni o'tkazgan."
Keyingi bir necha hafta davomida xitoy tilida so'zlashuvchi tahdid subyekti YiiMP platformasidan foydalanib kriptovalyuta qazib olish operatsiyalariga hujum qilish vositalarini tayyorlagan, shuningdek, iPhone'dagi zaifliklarni sinovdan o'tkazish va Android tizim dasturiy ta'minotini o'zgartirish uchun ish joyini tashkil etgan.
Zscaler ThreatLabz shundan beri hujum izining Janubiy Koreyadan tashqariga chiqqanini va global miqyosda hamda turli sohalarda tashkilotlarni tasodifiy nishonga olganini ochib berdi. Topilmalar AI yordamchi konfiguratsiyalari, sinxronizatsiya skriptlari, tarmoq marshrutlash vositalari va Claude Code tezkor tarixi (prompt history)ni o'z ichiga olgan maxsus ARTEX joylashtirishdan kelib chiqqan.
"ARTEX OpenAI-mos keladigan shlyuz orqali DeepSeek modelidan foydalanish uchun sozlangan, ammo boshqa konfiguratsiyalar ham DeepSeek, GLM va Grok'ni ko'rsatgan," — dedi xavfsizlik tadqiqotchisi Seongsu Park. "Tezkorlar AI modellariga tekshiruv vazifalarini bo'lish va bir-birining natijalarini tekshirishni buyurgan, jumladan, GLM'ga DeepSeek va uning kichik agentlari tomonidan bajarilgan ishni tekshirish bo'yicha ko'rsatmalar berilgan."
Tezkor tarixlarini tahlil qilish shaxsiy va tranzaksiya ma'lumotlarini ommaviy so'rash, shuningdek, o'g'irlangan ma'lumotlarni sotish haqida savollarni ochib bergan, bu hujumlar ehtimol moliyaviy maqsadli ekanini ko'rsatadi. Boshqa tezkorlar to'lov shlyuzi API kalitlarini olish, NFT zarb qilish (minting) ish oqimlarini suiiste'mol qilish va noqonuniy ma'muriy imtiyozlarni olish bilan bog'liq.
Topilmalar yana bir bor tahdid subyektlari agentik AI vositalarini o'z hujum ish oqimlariga tobora ko'proq integratsiya qilayotgani va bu ularga keng miqyosda tezkor hujumlarni amalga oshirish imkonini berayotganini ta'kidlaydi.
"Agentlar insonlarga ta'sir qiladigan omillar bilan cheklanmagan — ular tun-u kun, dam olish kunlari va bayramlarda ishlashi mumkin va bir vaqtning o'zida bir nechta buzilish yo'llarini sinab ko'rishi mumkin, bu maqsad tanlashdan maqsadga erishishgacha bo'lgan vaqtni sezilarli qisqartiradi, ta'minot zanjiri buzilishlari kabi murakkab hujumlarning tezligi va ta'sirini oshiradi," — dedi Microsoft.
Topilmalarga javoban ConnectWise aytishicha, bu faoliyat "har qanday bitta kompaniyadan ancha kengroq kampaniyani tasvirlaydi," va "milliy davlat subyektlari dasturiy ta'minot ta'minot zanjirini tobora ko'proq nishonga olmoqda, chunki bitta ishonchli ulanish ko'plab tashkilotlarga eshik ochishi mumkin."
"AI endi ularga ushbu ulanishlarni [...] 'mashina tezligida' sinovdan o'tkazish imkonini beradi. MSP'lar (boshqariladigan xizmat provayderlari) ushbu zanjirning o'rtasida. Ular o'zlari nishon, shuningdek, ular xizmat ko'rsatadigan har bir mijozga yo'l hamdir. Har bir sotuvchi va har bir MSP o'zini ushbu ikkala xavfni hisobga olgan holda himoya qilishi kerak."
ConnectWise, hujumlardan so'ng xizmatlarni vaqtincha to'xtatgan, xizmatlarni bosqichma-bosqich tiklamoqda, bu jarayon bir necha kun davom etishini aytgan.
Yangilanish
Keyingi tahlilda Google'ga tegishli Wiz Storm-0940'ning "boshqa dasturiy ta'minot sohalarida ta'minot zanjiri buzilish urinishlarini kengaytirayotganini" kuzatganini aytdi va "razvedka va hujum urinishlarining izchil ketma-ketligini" aniqlaganini qo'shdi, bu quyidagilarni o'z ichiga oladi:
- Ichki API yo'llari va ilova funksiyalarini aniqlash
- Kirish oqimlarini qayta-qayta boshlash va SSO hamda Microsoft 365'ga xos nuqtalarni tekshirish
- Korporativ Okta va Entra ID muhitlariga qarshi parol purkash hujumlarini o'tkazish
- Parolni tiklash, foydalanuvchi nomini tiklash, faollashtirish va tiklash tokeni nuqtalarini chaqirish
- Mumkin bo'lgan joyda bir martalik elektron pochta manzillari bilan hisob qayd etish va buzilgan kirish nazoratlari hamda ruxsat etilmagan o'zaro ijarachi ma'lumotlarga kirish uchun skanerlash
- Bloklanganda IP manzillarini almashtirish
"Faoliyat doimiy va yuqori darajada avtomatlashtirilgan edi," — deb yozdi Wiz tadqiqotchilari Sapir Federovsky va Rami McCarthy, kampaniyani dizayn bo'yicha tinimsiz deb ta'riflab. "Ba'zi sessiyalar 24-30 soat davom etgan, va IP'lar bloklanganda, bir necha daqiqa ichida yangi manzillar paydo bo'lgan."
"AI razvedka va suiiste'mol urinishlarini tezroq va kengaytirishni osonlashtirayotgani sababli, himoyachilar ta'sir va bartaraf etish o'rtasidagi bo'shliqni qisqartirishlari kerak."
(Maqola 2026-yil 23-oktabrda nashr etilgandan so'ng Wiz'dan qo'shimcha ma'lumotlar bilan yangilangan.)
Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.
During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims.
The tech giant said the threat actor used the AI tool at "machine speed" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.
"Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in," Microsoft said.
"AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access."
Storm-0940 was first detailed by Microsoft in November 2024, revealing that the threat actor has been leveraging a botnet called Quad7 (aka CovertNetwork-1658) to conduct highly evasive password spray attacks. The threat actor is assessed to be active since at least 2021.
The adversary is also said to exploit internet-facing applications to gain initial access, followed by using compromised accounts to move through targeted environments. It has also been observed establishing persistence by adding credentials to existing OAuth applications within cloud infrastructures to ensure access to Microsoft 365 resources.
According to Microsoft, a chunk of these ARTEX-driven attacks have resulted in the adversary gaining privileged access to an organization's cloud infrastructure, including several instances where the time frame from initial targeting to privileged access was less than 3 hours.
In the case of the ConnectWise incident, Storm-0940 has been observed using ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace the company said gives defenders a short window to detect and respond.
"Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online," Microsoft said.
During this window, Microsoft said it captured over 151,000 failed logon events. The activity peaked on October 11 at 2,900 failures per minute, resulting in more than 111,000 failures in a single day. Of these, 48 accounts received more than 1,000 failures. No successful authentication, token issuance, Graph call, or directory change was detected, it noted.
That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments.
"Additionally, after acquiring control of the identities of multiple ConnectWise cloud applications, the AI agents operating on behalf of the threat actor continued to use the same IP range to authenticate to customer environments using the illicit access acquired through these stolen app credentials, effectively taking advantage of the already established trust by these apps within a tenant," the tech giant added.
In some of these cases, the AI agents are assessed to have progressed beyond authentication to Microsoft Graph and directory operations. This included reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles.
The TAG-217 attack chain | Source: Zscaler
"The application credential modification made by Storm-0940’s associated agents in the targeted victims' environments can lead to persistence through other identities, credentials, and cloud services," Microsoft said. "These changes can remain active as a backdoor even after the original compromised application is mediated."
Storm-0940 is far from the only hacking crew to rely on ARTEX. Microsoft said it has observed threat actors across multiple geographic regions weaponizing the framework in their operations.
Recorded Future Insikt Group, which is tracking the threat cluster behind the attacks on South Korean financial institutions under the moniker TAG-217, said it identified activity linked to the hacking group dating back to August 17, 2026, when it "tested infrastructure designed to maintain remote access to computers and conducted internet scanning."
Over the next few weeks, the Chinese-speaking threat actor is said to have put together tools to attack cryptocurrency mining operations using the YiiMP platform, as well as set up a workspace for testing weaknesses in iPhones and modifying Android system software.
Zscaler ThreatLabz has since revealed that the attack's footprint extends beyond South Korea, and that it opportunistically targeted organizations around the globe and across multiple industry sectors. The findings come from a custom ARTEX deployment that included AI assistant configurations, synchronization scripts, network routing tools, and a Claude Code prompt history.
"ARTEX was configured to use a DeepSeek model through an OpenAI-compatible gateway, but other configurations also specified DeepSeek, GLM, and Grok," security researcher Seongsu Park said. "Prompts directed AI models to divide investigation tasks and review one another's findings, including instructions for GLM to review work performed by DeepSeek and its subagents."
An analysis of the prompt histories has revealed requests for bulk personal and transaction data, along with questions about selling stolen data, suggesting the attacks were likely financially motivated. Other prompts related to extracting payment gateway API keys, exploiting NFT minting workflows, and gaining unauthorized administrative privileges.
The findings once again highlight how threat actors are increasingly integrating agentic AI tools into their offensive security workflows to quickly carry out attacks at scale.
"Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously, enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises," Microsoft said.
In response to the findings, ConnectWise said the activity "describes a campaign that reaches well beyond any one company," adding "nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations."
"AI now lets them test those connections at [...] 'machine speed.' MSPs are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve. Every vendor and every MSP must defend itself with both of those risks in mind."
ConnectWise, which temporarily shut down services following the attacks, has been restoring services in phases, a process that it said will take several days.
Update
In a follow-up analysis, Google-owned Wiz said it observed Storm-0940 "expanding their attempted supply chain compromises into other software sectors," adding it identified a consistent sequence of reconnaissance and attack attempts" that involves -
- Discovering internal API routes and application functionality
- Repeatedly initiating sign-in flows and probing SSO and Microsoft 365-specific endpoints
- Conducting password-spraying attacks against corporate Okta and Entra ID environments
- Invoking password-reset, username-recovery, activation, and reset-token endpoints
- Registering accounts using throwaway email addresses where possible and scanning for broken access controls and unauthorized cross-tenant data access
- Rotating IP addresses when blocked
"The activity was persistent and highly automated," Wiz researchers Sapir Federovsky and Rami McCarthy said, describing the campaign as relentless by design. "Some sessions lasted 24–30 hours, and when IPs were blocked, new addresses appeared within minutes."
"As AI makes reconnaissance and exploitation attempts faster and easier to scale, defenders need to shorten the gap between exposure and remediation."
(The story was updated after publication on October 23, 2026, to include additional insights from Wiz.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.