Microsoft disclosed that Storm-0940, which has ties to the Chinese government, automated attacks targeting several hundred organizations worldwide using ARTEX, an AI-agent intrusion-testing framework. Storm-0940 may also have been involved in a supply-chain compromise involving cloud backups.
Microsoft announced that a group calling itself Storm-0940, which has ties to the Chinese government, used ARTEX, an AI-agent intrusion-testing framework, to automate attacks targeting several hundred organizations worldwide. The AI agent operates around the clock and can simultaneously attempt multiple intrusion routes, reportedly substantially shortening the time from target selection to achievement of the objective.
Storm-0940 is said to have remained active since around 2021 and to have attacked a range of industries for the purpose of stealing data. It was reported that examples of attacks using ARTEX included multiple cases in which attackers took less than 3 hours to obtain privileged access to an organization’s cloud infrastructure.
Since September, attacks have reportedly extended across a broad range of industries, including aerospace and defense, automotive, chemicals, energy, financial services, government agencies, legal services, manufacturing, media, the military, semiconductors, software, technology, think tanks and nonprofit organizations.