Xitoy bilan bog'liq tahdid aktori ochiq manbali AI pentest tizimi Artexdan foydalanib, Microsoft ma'lumotiga ko'ra, yuzlab tashkilotlarga qaratilgan so'nggi ConnectWise xakerlik kampaniyasini avtomatlashtirgan.
Storm-0940 nomi bilan kuzatiladigan va kamida 2021-yildan beri faol bo'lgan APT, parol purkash (password spraying) va zaif internetga ochiq ilovalarni ekspluatatsiya qilish orqali turli sohalardagi tashkilotlarga kirish bilan tanilgan.
2026-yil sentyabr boshidan boshlab, tahdid aktori hujumlarini avtomatlashtirish uchun Artexdan foydalanayotgani kuzatilgan va CrowdStrike, Zscaler hamda Recorded Future tomonidan e'lon qilingan oldingi hisobotlar bu AI yordamidagi faoliyatni Janubiy Koreya moliyaviy muassasalariga qaratilgan hujumlar bilan bog'lagan.
Endi Microsoft ma'lumotiga ko'ra, Storm-0940 Artexdan foydalanib, oktyabr o'rtalarida ConnectWise mijozlari muhitlariga kirishni avtomatlashtirgan. Bunga javoban, ConnectWise bir nechta xizmatlarni, jumladan Cloud Backup, SaaS Security va Cloud Managementni to'xtatgan.
O'sha paytda Huntress hujumchilarning buzilgan ConnectWise ilova ma'lumotlaridan foydalanib, yuzlab Microsoft 365 ijarachilariga, shu jumladan 300 dan ortiq Entra ijarachilariga kirganini kuzatgan.
Microsoft ma'lumotiga ko'ra, tahdid aktori Artexdan foydalanib, razvedka (reconnaissance), parol purkash va OAuth ilova suiiste'molini tezlashtirgan. U sakkizta tashkilot bo'yicha 300 dan ortiq hisobga daqiqasiga 2900 dan ortiq urinish tezligida hujum qilgan. Reklama. O'qishni davom ettirish uchun pastga aylantiring.
"Ruxsatsiz kirishdan so'ng, Storm-0940 Artexdan foydalanib, 2250 dan ortiq ijarachiga kirishga uringan. OAuth ilova suiiste'moli Storm-0940 vositalar to'plamining odatiy qismi bo'lsa-da, bu holatda aktor faoliyatni mashina tezligiga tezlashtirish uchun Artexdan foydalangan", — deydi Microsoft.
Microsoft hujumlar bilan bog'liq 151 000 dan ortiq muvaffaqiyatsiz kirish hodisalarini qayd etgan, shuningdek, bir nechta ConnectWise bulut ilovalarining shaxsiyatlari yordamida mijoz muhitlariga muvaffaqiyatli autentifikatsiya qilishni ham kuzatgan.
"Ushbu muhitlarning ba'zilarida AI agentlari (tahdid aktori nomidan) autentifikatsiyadan o'tib, Microsoft Graph va katalog operatsiyalariga, jumladan razvedka, ilova ma'lumotlarini o'zgartirish orqali doimiy kirishni ta'minlash, shuningdek shaxsiyatlar, guruhlar va imtiyozli rollar bilan bog'liq o'zgarishlarga o'tgan", — deb tushuntiradi Microsoft.
Ilova ma'lumotlarini o'zgartirish orqali hujumchilar ta'sirlangan ilova tuzatilganidan keyin ham jabrlanuvchi muhitlariga doimiy kirishni ta'minlagan, deb ogohlantiradi Microsoft.
"Tashkilotlar xizmat prinsipal kirishlarini keyingi Microsoft Graph faoliyati, katalog o'zgarishlari va resurslarga kirish bilan birga tekshirib, shubhali hodisalarni ruxsat etilgan ma'muriy faoliyat bilan solishtirishlari kerak", — deb ta'kidlaydi texnologiya giganti.
Microsoft ma'lumotiga ko'ra, sentyabr boshidan beri Storm-0940 Artexdan foydalanib, aerokosmik, avtomobil, kimyo, mudofaa, energetika, moliyaviy xizmatlar, hukumat, huquq, ishlab chiqarish, media, harbiy, yarimo'tkazgich, dasturiy ta'minot va texnologiya sohalaridagi yuzlab tashkilotlarga, shuningdek notijorat tashkilotlar va fikr markazlariga qarshi avtomatlashtirilgan hujumlar amalga oshirgan.
Bu hafta Zscaler Storm-0940ning AI yordamidagi hujumlari haqida texnik chuqur tahlil e'lon qildi, jumladan tahdid aktorining Artexdan foydalanishi, uning konfiguratsiyalari, sinxronizatsiya skriptlari, Claude Code prompt tarixi va tarmoq marshrutlash vositalari haqida tafsilotlar kiritilgan.
Bog'liq: Eronning "Fors shahzodasi" APT C&Cni 2016-yildan beri birinchi marta AQShda joylashtirgan
Bog'liq: LiteLLM yangi ta'minot zanjiri hujumida buzilgan
Bog'liq: Xitoy AI modeli AQSh pudratchisi uchun yozilganda ko'proq zaif kod yozadi
Bog'liq: PHP2Shell ekspluatatsiyasi patchlardan bir necha kun oldin boshlangan
Yozgan: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik xabarnoma
Eng so'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari uchun SecurityWeek elektron xabarnomasiga obuna bo'ling.
Ionut Arghiredan ko'proq
Signal zaifligi zararli qo'ng'iroq qiluvchilarga qo'ng'iroqni to'xtatishni bloklashga imkon beradi Splunk, SolarWinds yangi xavfsizlik yangilanishlarini e'lon qildi Cisco bir nechta mahsulotlar bo'yicha 34 zaiflikni tuzatdi PHP2Shell ekspluatatsiyasi patchlardan bir necha kun oldin boshlangan PHP2Shell patchlari birinchi ekspluatatsiya urinishlari sensorlarga yetib kelganida e'lon qilindi Chrome'ning 353 ta yangi xavfsizlik tuzatishlarining aksariyati xotira xatolari Brauzerlar tiklanadigan shaxsiy kalitlar tufayli eMudhra oraliq CA'larini bloklaydi Xitoy AI modeli AQSh pudratchisi uchun yozilganda ko'proq zaif kod yozadi
A China-linked threat actor has been using the open source AI penetration testing framework Artex to automate a recent ConnectWise hacking campaign targeting hundreds of organizations, Microsoft reports.
Tracked as Storm-0940 and active since at least 2021, the APT is known for relying on password spraying and the exploitation of vulnerable internet-facing applications to hack into organizations across multiple sectors.
Starting in early September 2026, the threat actor was seen abusing Artex to automate its attacks, and previous reporting by CrowdStrike, Zscaler, and Recorded Future linked this AI-powered activity to attacks targeting South Korean financial institutions.
Now, Microsoft says Storm-0940 used Artex to automate intrusions into ConnectWise customers’ environments in mid-October. In response, ConnectWise suspended several services, including Cloud Backup, SaaS Security, and Cloud Management.
At the time, Huntress observed the attackers using compromised ConnectWise application credentials to access hundreds of Microsoft 365 tenants, including over 300 Entra tenants.
According to Microsoft, the threat actor relied on Artex to accelerate reconnaissance, password spraying, and OAuth application abuse. It hit over 300 accounts across eight organizations at a pace of more than 2,900 attempts per minute.Advertisement. Scroll to continue reading.
“Following the unauthorized access, Storm-0940 used Artex to attempt to sign-in to more than 2,250 tenants. While OAuth application abuse is a typical part of Storm-0940’s toolset, in this case the actor used Artex to accelerate the activity to machine speed,” Microsoft says.
Microsoft captured 151,000+ failed logon events associated with the attacks, but also observed successful authentication to customer environments using the identities of multiple ConnectWise cloud applications.
“In some of these environments, the AI agents (on behalf of the threat actor) progressed beyond authentication to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles,” Microsoft explains.
By changing application credentials, the attackers ensured persistent access to the victims’ environments even after the affected application was remediated, Microsoft warns.
“Organizations should examine service principal sign-ins alongside subsequent Microsoft Graph activity, directory changes, and resource access, correlating suspicious events with authorized administrative activity,” the tech giant notes.
According to Microsoft, since early September, Storm-0940 has used Artex in automated attacks against hundreds of organizations across the aerospace, automotive, chemicals, defense, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, and technology sectors, as well as against non-profits and think tanks.
This week, Zscaler published a technical deep-dive into Storm-0940’s AI-assisted attacks, including details on how the threat actor uses Artex, its configurations, synchronization scripts, a Claude Code prompt history, and network routing tools.
Related: Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016
Related: LiteLLM Compromised in Fresh Supply Chain Attack
Related: Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Related: PHP2Shell Exploitation Started Days Before Patches
Written By Ionut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
More from Ionut Arghire
Signal Vulnerability Lets Malicious Callers Block Hang-Ups Splunk, SolarWinds Release Fresh Security Updates Cisco Patches 34 Vulnerabilities Across Multiple Products PHP2Shell Exploitation Started Days Before Patches PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors Memory Bugs Account for Most of Chrome’s 353 New Security Fixes Browsers Block eMudhra Intermediate CAs Over Recoverable Private Keys Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
Latest News
Attackers Exploit Third VeloCloud Orchestrator Zero-Day in Four Months 11 Million Impacted by Capcom Data Breach Quest Diagnostics Reports Cyber Breach Affecting ‘Certain Patient Records’ LiteLLM Compromised in Fresh Supply Chain Attack Atlassian Patches 75 Flaws in Data Center and Server Products Iran’s Prince of Persia APT Hosts C&C in US for First Time Since 2016 Hacker Conversations: Corey Thuen and the Evil Bit Indurex Raises $8 Million to Expand Industrial Cybersecurity Platform
Trending
PHP2Shell: Mass Exploitation Looms for Leaked Critical PHP Flaws
PHP2Shell Patches Land as First Exploitation Attempts Hit Sensors
Tech and Security Companies Respond to PHP2Shell Vulnerabilities
Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
PHP2Shell Exploitation Started Days Before Patches
Cisco Patches 34 Vulnerabilities Across Multiple Products
Signal Vulnerability Lets Malicious Callers Block Hang-Ups
Google Hardens Chrome Against ClickFix Attacks, Insecure HTTP Connections
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Webinar: The AI Access Risk Already in Your Google Workspace
October 19, 2026
AI tools connected to Google Workspace can access millions of sensitive emails and files. Join this session to uncover your organization’s risk and learn a framework to manage AI access.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Jon Steinbach has been appointed strategic technical advisor to the Pentagon’s CIO.
Vasu Jakkal has joined Armadin as CSBO.
Ivanti has named Robert Ruelas as CRO and Sterling Parker as CCO.
More People On The MoveExpert Insights
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk. (Matias Madou)