Microsoft: China-linked Storm-0940 used open-source ARTEX AI agent to breach clouds in under 3 hours
rohanpaul_ai · x · 2026-10-22
Microsoft's security team reports that China-state-aligned actor Storm-0940 used ARTEX, an open-source LLM agent framework, to automate attacks on hundreds of organizations worldwide.
- ARTEX chains LLM agents through a full pentest from recon to data theft with little human input
- Attackers abused keys to ConnectWise's trusted Microsoft 365 backup/management apps, skipping user logins and MFA
- Several intrusions went from first targeting to privileged cloud access in under 3 hours; agents queried Microsoft Graph, added credentials to other apps, and had a ConnectWise app grant itself Global Administrator
- Most attempts still failed (a password spray logged 151K+ failures with zero success), and app sign-ins alone don't prove theft
- OAuth abuse isn't new for Storm-0940, but ARTEX's speed leaves defenders little time between alert and revocation
More from coding & agent
- Beacon open-sources a cross-harness self-improving memory layer for 20+ coding agents — solyarisoftware · 2026-10-22
- After 4 CVSS-10 CVEs in 24 hours, a team builds an auto-SRE tool that fixes itself — viksit · 2026-10-22
- Pi v1.4.0 ships image classification in codemode and fixes summary truncation — solyarisoftware · 2026-10-22
- Claude Code 2.1.308 Adds ~11K Prompt Tokens Just 8 Hours After 2.1.307 — ClaudeCodeLog · 2026-10-22
- Claude Code 2.1.308 ships CLI bug fixes and reliability improvements — ClaudeCodeLog · 2026-10-22
- OpenAI Engineer Asks Users What Would Make the OpenAI CLI More Useful — pbbakkum · 2026-10-22