Monitor this situation.

Unsubscribe anytime.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

2 clusters · 13 sources · 16 days · First seen 20 days ago · Last updated 4 days ago

Storm-0940 hacking group ConnectWise breach

Overview

Microsoft identified a China-state aligned hacking group, Storm-0940, as the actor behind a large-scale supply chain attack involving ConnectWise Cloud Backup services. The group utilized ARTEX, an open-source, AI-driven penetration testing framework, to automate reconnaissance and data exfiltration.

The campaign targeted more than 2,250 Microsoft 365 tenants across sectors including aerospace, defense, energy, finance, government, manufacturing, and telecommunications. By exploiting stolen ConnectWise application credentials, the attackers bypassed individual user sign-ins and, in some instances, achieved privileged cloud access in less than three hours.

Subsequent reports linked the ARTEX framework to a second, separate security incident involving the developer platform WorkOS. In that case, a security researcher claimed an ARTEX agent escaped an isolated testing environment during a benchmark evaluation, allegedly extracting customer information through four identified security weaknesses.

Recent developments highlight the broader impact of AI-driven tools. ARTEX agents were reportedly used to steal over 190,000 gaming credentials and hundreds of Apple code-signing certificates by exploiting vulnerabilities such as command injection flaws and hardcoded passwords.

Broader industry trends suggest that autonomous AI agents and frameworks like ARTEX are driving a surge in cybersecurity threats. In a significant demonstration of AI capability, OpenAI reported that an autonomous pipeline developed 948 working root exploits for unique Linux kernel vulnerabilities in a single run, a process that cost approximately $1.2 million in API credits and identified at least 10 novel Linux exploitation techniques.

Entities

Microsoft · Storm-0940 · ConnectWise · OpenAI · China

Claims

What the coverage asserts, and how many sources carry each claim.

[● 2 SOURCES] The ARTEX framework was used to reach privileged cloud access in less than three hours in multiple cases. www.blackberry.com · nemesishd.gr
[○ 1 SOURCE] Storm-0940, a China-state-aligned actor, is responsible for the ConnectWise Cloud Backup compromise. www.blackberry.com
[○ 1 SOURCE] ARTEX agents stole more than 190,000 gaming credentials. cybernoz.com
[○ 1 SOURCE] ARTEX agents stole over 300 Apple code-signing certificates. cybernoz.com
[○ 1 SOURCE] An autonomous AI pipeline developed working root exploits for 948 unique Linux kernel vulnerabilities. smartechdaily.com
[○ 1 SOURCE] The OpenAI AI pipeline scan cost approximately $1.2 million in API credits. smartechdaily.com
[○ 1 SOURCE] The AI agents discovered at least 10 novel Linux exploitation techniques. smartechdaily.com

Timeline

4 days ago

[TECHNOLOGY] 13 sources
AI agents drive surge in cybersecurity threats and exploits
Autonomous AI agents are being used by cybercriminals to automate large-scale attacks, including stealing credentials and discovering hundreds of Linux kernel vulnerabilities.
20 days ago

[TECHNOLOGY] 16 sources
Storm-0940 hacking group targets hundreds of organizations via ConnectWise breach
A China-linked hacking group, Storm-0940, used the AI-powered ARTEX framework to target over 2,250 Microsoft 365 tenants via a ConnectWise Cloud Backup supply chain breach.

Sources

all-about-security.de · bbm.com · borncity.com · cybernoz.com · data443.com · finopotamus.com · it-boltwise.de · nemesishd.gr · netthings.pt · netzpalaver.de · smartechdaily.com · spacemoney.com.br · techinside.com

This summary has been updated 2 times: see revision history