China-state-aligned hackers used ARTEX, an AI-powered penetration-testing framework, to attempt access to more than 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach.

Microsoft attributed the attack to Storm-0940 and reported 2,900 sign-in attempts per minute, leaving security teams little time to investigate and block access.

The attackers abused stolen application credentials and permissions already approved by customers, rather than requiring users to enter passwords.

Earlier reporting on compromised ConnectWise backup credentials documented unauthorized sign-ins across 173 tenants.

That confirmed-access figure differs from Microsoft’s broader targeting count: not every attempted sign-in succeeded, and successful authentication alone does not prove data theft.

Researchers from Zscaler and Microsoft teams separately documented ARTEX abuse in reports published October 21. ARTEX is a security-testing framework, not a newly discovered malware family.

Microsoft attributed the ConnectWise attack to Storm-0940, while Zscaler examined a Chinese-speaking operator’s broader workflow without establishing that both investigations covered the same actor.

China-Linked Hackers Use ARTEX AI

According to Microsoft’s technical investigation report, Storm-0940 used ARTEX for scanning, password spraying, and OAuth application abuse.

Between October 10 and 14, its infrastructure targeted 327 accounts across eight organizations, generating more than 151,000 failed logons. Microsoft observed no successful authentication during that password-spray activity.

Architectural diagram of AI-assisted attack environment using ARTEX (Source – Zscaler)

The group previously used stolen accounts for network access, as coverage of Storm-0940 password spray attacks explains. In the ConnectWise incident, however, stolen application credentials provided another route.

The attackers authenticated as trusted applications, using permissions already granted inside customer tenants without an interactive user sign-in.

After gaining control of multiple ConnectWise application identities, the attackers used Microsoft Graph to inspect environments and change application credentials.

Some activity involved identities, groups, and privileged roles. These changes could preserve access through other applications even after the original ConnectWise connection was disabled. Microsoft said several ARTEX-driven attacks reached privileged cloud access in under three hours.

Zscaler’s investigation showed how an operator combined ARTEX with Claude Code, Codex, and other AI workspaces. The framework divided goals into tasks, ran security tools, and retained findings.

Custom additions included nmap, sqlmap, nuclei, and Android analysis tools, extending its reach across websites, networks, and mobile applications.

The findings expand on earlier South Korean financial breaches involving ARTEX, with Zscaler finding targets across many countries and sectors.

Scale and speed of a subset of Storm-0940’s automated ARTEX campaign (Source - Zscaler) — Scale and speed of a subset of Storm-0940’s automated ARTEX campaign (Source – Zscaler)

Saved prompts requested personal records, phone numbers, payment credentials, and transaction data. Questions about selling stolen records suggested financial motives, but did not establish that any sale occurred.

Shared notes and synchronization scripts let separate AI sessions resume unfinished work. Prompts assigned DeepSeek initial research and GLM review duties, while other sessions used Grok configurations.

Zscaler cautioned that configured model names did not prove which underlying models answered requests. The operator also instructed agents to assume targets were authorized and reduced approval requirements.

What Defenders Should Check

Microsoft recommends keeping affected ConnectWise connections disabled until formal restoration guidance arrives.

Teams should preserve evidence before deleting applications and examine service-principal sign-ins, application credential additions, consent grants, and role changes.

Investigations should include previously authorized integrations, because removing the original connection may leave attacker-added credentials elsewhere.

Review should extend beyond published IP addresses to unusual Microsoft Graph activity, mailbox access, file downloads, forwarding rules, and unexpected owners. Microsoft said the activity did not stem from a vulnerability or compromise in its own systems, products, or services.

Indicators of compromise (IoCs):-

Source	Type	Indicator	Reported context
Microsoft	IP	`144.172.64[.]128`, `144.172.64[.]99`, `144.172.64[.]60`	Sign-ins and Graph activity
Microsoft	VPN IP	`187.15.88[.]186`, `187.15.90[.]217`, `187.15.89[.]186`	Time-limited Graph investigation
Microsoft	User agent	`Python-urllib/3.12`, `python-requests/2.31.0`, `python-requests/2.34.2`, `curl/7.88.1`, `azure-toolkit/1.0`	Observed application activity
Microsoft	Application ID	`506e08f9-6e9a-4da4-942b-a099a03644ae`	ConnectWise Cloud Backup
Microsoft	Application ID	`24205314-2b89-4e07-a2a4-579e898a5640`	ConnectWise MS Teams
Microsoft	Application ID	`0de14c77-b9b0-4137-9360-34878a929827`	ConnectWise MS Graph
Zscaler	IP	`23.248.226.250`, `23.248.226.251`, `23.248.226.252`, `23.248.226.253`, `23.248.226.254`	Work servers
Zscaler	IP	`38.244.50.120`	Jump server
Zscaler	Endpoint	`154.201.79.246:443`	Proxy pool API
Zscaler	Endpoint	`205.214.59.31:443`, `161.8.161.140:11005`	Upstream SOCKS proxies

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach appeared first on Cyber Security News.