Storm-0940 exploitation of ARTEX framework for supply chain compromise
Storm-0940, a China-state aligned actor, is using the ARTEX agentic AI framework to automate and accelerate supply chain compromise, specifically targeting ConnectWise application identities to gain unauthorized access to Microsoft 365 environments.
Triage facts
Revision 1- Evidence
- Confirmed activeMedium confidence
- Severity
- Critical
- Sources
- 2 public sources
- Freshness
- Revision 1Oct 21, 19:54 UTC
- Source quality
- B2Likely
Storm-0940 has utilized the ARTEX penetration testing framework to automate attacks against hundreds of organizations. By compromising ConnectWise applications, the actor has accessed downstream customer tenants at high speeds, sometimes reaching privileged infrastructure in less than 3 hours. The actor uses these compromised application identities to perform reconnaissance, modify application credentials for persistence, and access Microsoft 365 resources via Microsoft Graph. This activity did not involve the compromise of Microsoft corporate systems or products.