```
AI Pentesting Tool ARTEX Deployed in Microsoft 365 Campaign Tied to Storm-0940, Microsoft Says
Microsoft says a group it tracks as Storm-0940 — and describes as "linked to China" — deployed an AI-driven penetration testing framework in a campaign reaching 2,250 Microsoft 365 tenants, with initial access obtained through stolen credentials in the ConnectWise Cloud Backup supply chain. The company laid out the operation in a technical report, which Security Affairs covered in detail.
AI-assisted offensive tooling has circulated in research and proof-of-concept work for some time. ARTEX appearing inside a named, large-scale campaign marks the shift from demonstration to production use.
Reading the attribution correctly
Microsoft did not say Storm-0940 is state-controlled. It said the group is linked to China — a formulation that typically rests on correlated infrastructure, shared tooling and victimology rather than a formal intelligence judgement. That is the industry norm for vendor threat-intelligence language, and the distinction carries: repeating "linked to" as a state-actor claim would assert more than Microsoft concluded.
What ARTEX actually is
ARTEX is an open-source, AI-driven penetration testing framework. In this operation, Microsoft says, it was used to run reconnaissance and attack steps at machine speed against a large tenant list. The volume and tempo of the activity — not the existence of the tool itself — is what changed here.
Trust abuse, not exploitation
The initial access vector was credential theft, not a software vulnerability. Stolen ConnectWise credentials carried legitimate managed service provider context, so the traffic blended into normal administrative behaviour coming from a trusted integration account — a pattern that can sidestep multi-factor protection applied at the point of compromise and bypass simple allow-listing.
That reframes what defenders should be looking for. With 2,250 tenants targeted, the alertable signal is not an exotic exploit artefact but unusually rapid and wide-ranging administrative activity originating from a trusted integration account. Prevention weight shifts toward integration hygiene and tenant-level monitoring; detection engineering absorbs the rest.
Why it matters beyond the incident
For IT teams running Microsoft 365 alongside ConnectWise or similar RMM/backup integrations, the story is a capability signal rather than a geopolitical one: AI-compressed reconnaissance cycles shorten the window between access and escalation, and supply-chain credentials function as a direct path into customer environments. Microsoft has not disclosed how many of the targeted tenants were successfully accessed, nor expanded publicly on the basis for its state-link assessment.
Editorial advisory: remediation checklist
The following checklist is editorial guidance compiled by the HKLUG team, not material from Microsoft's report. It is offered as general hygiene advice for teams administering M365 tenants with ConnectWise-managed backup or RMM integrations — not a report on any local incidents.
- Inventory integration accounts: List every third-party integration and service account holding tenant-administration rights, and confirm each is still required.
- Rotate and audit credentials: Change passwords for all ConnectWise-related accounts, and review recent sign-in sources, devices and time-zone anomalies.
- Enforce MFA and conditional access: Restrict privileged accounts to managed devices, and apply location- and risk-based conditions.
- Review app consent: Revoke OAuth application grants that are unused or from unknown sources.
- Baseline account behaviour: Set alert thresholds on integration-account activity frequency, command volume and time windows.
- Verify backup and restore privileges: Confirm Cloud Backup restore permissions have not been widened, and test the most recent restore.
- Stay updated and monitored: Track follow-up advisories from Microsoft and ConnectWise, and continue reviewing tenant audit logs.
Source: Security Affairs coverage of Microsoft's technical report. All figures, tenant counts and attribution wording in this article are as reported by Microsoft via that coverage; readers seeking primary detail should consult Microsoft's published technical report directly.
```
微軟：與 Storm-0940 有關的 Microsoft 365 攻擊行動動用 AI 滲透測試工具 ARTEX
微軟表示，一個被其追蹤、代號為 Storm-0940、並被描述為「與中國有關連」的組織，在一項涉及 2,250 個 Microsoft 365 租戶（tenant）的攻擊行動中，部署了 AI 驅動的滲透測試框架，其初始存取（initial access）是透過 ConnectWise Cloud Backup 供應鏈中的被盜憑證取得。微軟在一份技術報告中詳述了該次行動的運作方式，Security Affairs 曾作詳細報導。
AI 輔助的攻擊工具已在研究及概念驗證（proof-of-concept）工作中流傳一段時間。ARTEX 出現在一個具名的大規模攻擊行動之內，標誌著由示範階段轉入實際生產用途的轉變。
正確理解歸因（attribution）
微軟並未表示 Storm-0940 受國家控制，只稱該組織與中國「有關連」——這種說法通常基於互相關聯的基礎設施、共用工具以及受害對象特徵（victimology），而非正式的情報判斷。這是業界廠商威脅情報用語的常態，此一區分亦有其實質意義：若把「有關連」重述為國家行為者的指稱，便會超出微軟的結論範圍。
ARTEX 究竟是什麼
ARTEX 是一個開源、AI 驅動的滲透測試框架。微軟表示，在本次行動中，它被用來以機器速度對大量租戶名單進行偵察（reconnaissance）及攻擊步驟。改變的是活動的規模與節奏——而非工具本身的存在。
濫用信任，而非利用漏洞
初始存取途徑（initial access vector）是憑證竊取，而非軟件漏洞。被盜的 ConnectWise 憑證載有合法託管服務供應商（managed service provider）的上下文，相關流量因而混入來自可信整合帳號（integration account）的正常管理操作之中——這種模式可避開在妥協點部署的多重認證（multi-factor）保護，並繞過過於簡單的白名單（allow-listing）機制。
這重新定義了防禦者應留意的目標。在 2,250 個租戶受攻擊的情況下，可發出告警的信號並非罕見的漏洞利用痕跡（exploit artefact），而是源自可信整合帳號、異常迅速且涉及範圍廣泛的管理活動。預防工作的重心轉向整合層面的衛生管理（integration hygiene）與租戶層級監控；其餘則交由偵測工程（detection engineering）承擔。
為何此事的重要性超越單一事件
對於同時運行 Microsoft 365 與 ConnectWise 或同類 RMM／備份整合的 IT 團隊而言，這則消息是一個能力信號，而非地緣政治信號：經 AI 壓縮的偵察循環縮短了從初始存取到權限提升（escalation）之間的時間窗口，而供應鏈憑證則成為直入客戶環境的途徑。微軟尚未披露受攻擊租戶中有多少個成功遭到存取，亦未就其國家關連評估的理據作公開補充。
編輯附註：修復檢查清單
以下檢查清單為 HKLUG 團隊整理的編輯指引，並非來自微軟報告的材料。此處僅作為一般衛生管理建議，供管理配備 ConnectWise 託管備份或 RMM 整合的 M365 租戶的團隊參考——並非針對任何本地事件的報告。
- 盤點整合帳號：列出所有具備租戶管理權限的第三方整合與服務帳號，逐一確認是否仍屬必要。
- 輪換並審核憑證：針對 ConnectWise 相關帳號全面改密，檢查近期登入來源、裝置與時區異常。
- 強化 MFA 與條件式存取：限制高權限帳號只可由受管理裝置存取，套用位置與風險條件。
- 檢視應用程式同意：撤銷不再使用或來源不明的 OAuth 應用程式授權。
- 建立基準行為：為整合帳號設定操作頻率、指令數量與時間窗的告警閾值。
- 核對備份與還原權限：確認 Cloud Backup 的還原權限未被擴大，並測試最近一次還原。
- 保持更新與監控：追蹤 Microsoft 與 ConnectWise 的後續公告，並持續監察租戶稽核記錄。
來源：Security Affairs 對微軟技術報告的報導。本文所有數字、租戶數目及歸因措辭均按微軟透過該報道所述；讀者如需一手細節，請直接參閱微軟已發表的技術報告。