Microsoft 报告：中国背景组织 Storm-0940 用开源 AI 智能体 Artex 自动化攻击
微软点名 Storm-0940 用开源智能体 Artex 打自动化攻击，3 小时内拿下云权限，安全团队得看看这套打法。
Microsoft 发布报告称，中国国家背景黑客组织 Storm-0940 使用名为 Artex 的 AI 智能体对全球数百个组织实施自动化网络攻击。Artex 在 GitHub 上以开源形式发布，能将多个 LLM 智能体串联起来，从侦察到数据窃取几乎无需人工介入。攻击利用了 ConnectWise 的 Microsoft 365 备份管理应用密钥，绕过用户登录和 MFA。部分由 Artex 驱动的入侵从首次定位目标到获得云端特权访问用时不到 3 小时，曾在租户内查询 Microsoft Graph、向其他应用添加凭据，并让 ConnectWise 应用自授 Global Administrator 权限。多数攻击仍然失败，其中一次密码喷洒尝试记录了超过 15.1 万次失败登录且无一成功。
Microsoft published a new report saying that it has seen cyberattacks carried out by a Chinese state-aligned actor called Storm-0940, which used a Chinese AI agent named Artex to automate attacks aimed at hundreds of organizations worldwide in a broad range of industries.
ARTEX, released on GitHub as open source, chains LLM agents through a penetration test from reconnaissance to data theft with little human input.
The keys belonged to ConnectWise’s Microsoft 365 backup and management apps, already trusted with wide access, so signing in skipped user logins and MFA.
Several ARTEX-driven intrusions went from first targeting to privileged cloud access in under 3 hours.
Inside some tenants, the agents queried Microsoft Graph, added credentials to other apps and had a ConnectWise app grant itself Global Administrator.
Most targeting still failed, including a password spray that logged 151K+ failures without one success, and an app sign-in alone does not prove theft.
OAuth app abuse is old Storm-0940 tradecraft, but ARTEX ran it fast enough to leave defenders little time between alert and revocation.
