Microsoft Warns of AI Agent-Powered Attacks

Microsoft said on October 21 local time that Storm-0940, an attack group linked to the Chinese state, is automating attacks with ARTEX, a penetration-testing framework equipped with AI agents, and targeting hundreds of organizations worldwide. The company also attributed a supply-chain attack through ConnectWise’s cloud backup service, disclosed in mid-October, to Storm-0940.

Storm-0940 has been active since 2021 and has targeted a range of industries to steal data. It began using ARTEX around September. The open-source penetration-testing tool can be paired with any AI model to automate activity from reconnaissance to data exfiltration with little human involvement. Its interface supports English, Japanese, Korean, Chinese and Spanish. Targets include aerospace and defense, automotive, finance, government, semiconductors, software, media and think tanks. In October, ARTEX misuse was also reported in a personal-data breach targeting a South Korean financial institution.

Microsoft says AI agents can operate around the clock, including holidays, and try multiple routes into systems at once, sharply shortening the time from selecting a target to achieving an objective. In multiple cases, attackers took less than three hours after targeting an organization to obtain administrator-level privileges in its cloud environment. Most attacks failed, Microsoft said, but attackers still breached many organizations in a short period and maintained persistent access.

In the ConnectWise attack, attackers stole credentials for apps such as ConnectWise Cloud Backup and abused permissions already granted to those apps in customers’ Microsoft 365 environments. By impersonating legitimate apps, they could enter customer environments without users signing in. They attempted sign-ins across more than 2,250 organizations’ tenants at a rate of 2,900 per minute. In some cases, they gathered information, added credentials and granted administrator privileges. Those changes could remain as backdoors even after the original app is addressed. Microsoft said the attack did not exploit vulnerabilities in its systems or products, and that evidence of intrusion alone does not mean data was viewed or taken.

GMO Cybersecurity by Ierae also announced on October 19 that it had confirmed ARTEX misuse in unauthorized access attempts targeting Japanese companies. The source of the attacks it observed targeted about 20 Japanese companies, eight of which had disclosed data breaches in September and October. Microsoft said attackers using ARTEX were present in multiple regions, but did not comment on whether the attacks in Japan were connected to Storm-0940.

Microsoft urged organizations that currently use or previously used ConnectWise cloud-backup-related apps with Microsoft 365 to take precautions. Until ConnectWise provides formal recovery instructions, it advised disabling connections for affected apps and not deleting the apps during initial response, to preserve evidence. It recommended reviewing sign-in records and audit logs from at least October 15, and from October 1 if possible, for unrecognized credential additions, permission changes, and suspicious access to emails or files. If unauthorized activity is confirmed, organizations should revoke permissions and update credentials. As general measures, Microsoft advised limiting external apps to the permissions they need and continuously monitoring credential additions and permission changes for apps with elevated privileges.

Microsoft said on October 21 local time that Storm-0940, an attack group linked to the Chinese state, is automating attacks with ARTEX, a penetration-testing framework equipped with AI agents, and targeting hundreds of organizations worldwide. The company also attributed a supply-chain attack through ConnectWise’s cloud backup service, disclosed in mid-October, to Storm-0940.

Storm-0940 has been active since 2021 and has targeted a range of industries to steal data. It began using ARTEX around September. The open-source penetration-testing tool can be paired with any AI model to automate activity from reconnaissance to data exfiltration with little human involvement. Its interface supports English, Japanese, Korean, Chinese and Spanish. Targets include aerospace and defense, automotive, finance, government, semiconductors, software, media and think tanks. In October, ARTEX misuse was also reported in a personal-data breach targeting a South Korean financial institution.

Microsoft says AI agents can operate around the clock, including holidays, and try multiple routes into systems at once, sharply shortening the time from selecting a target to achieving an objective. In multiple cases, attackers took less than three hours after targeting an organization to obtain administrator-level privileges in its cloud environment. Most attacks failed, Microsoft said, but attackers still breached many organizations in a short period and maintained persistent access.

In the ConnectWise attack, attackers stole credentials for apps such as ConnectWise Cloud Backup and abused permissions already granted to those apps in customers’ Microsoft 365 environments. By impersonating legitimate apps, they could enter customer environments without users signing in. They attempted sign-ins across more than 2,250 organizations’ tenants at a rate of 2,900 per minute. In some cases, they gathered information, added credentials and granted administrator privileges. Those changes could remain as backdoors even after the original app is addressed. Microsoft said the attack did not exploit vulnerabilities in its systems or products, and that evidence of intrusion alone does not mean data was viewed or taken.

GMO Cybersecurity by Ierae also announced on October 19 that it had confirmed ARTEX misuse in unauthorized access attempts targeting Japanese companies. The source of the attacks it observed targeted about 20 Japanese companies, eight of which had disclosed data breaches in September and October. Microsoft said attackers using ARTEX were present in multiple regions, but did not comment on whether the attacks in Japan were connected to Storm-0940.

Microsoft urged organizations that currently use or previously used ConnectWise cloud-backup-related apps with Microsoft 365 to take precautions. Until ConnectWise provides formal recovery instructions, it advised disabling connections for affected apps and not deleting the apps during initial response, to preserve evidence. It recommended reviewing sign-in records and audit logs from at least October 15, and from October 1 if possible, for unrecognized credential additions, permission changes, and suspicious access to emails or files. If unauthorized activity is confirmed, organizations should revoke permissions and update credentials. As general measures, Microsoft advised limiting external apps to the permissions they need and continuously monitoring credential additions and permission changes for apps with elevated privileges.