[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fS9GcXEBom4VoAPWBDNXv-Pvaxevs_4QTO01-7-JP5F8":3},{"article":4,"iocs":59,"watch_terms":63,"solutions":64,"lesson":155},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"23ce3c19-4074-48db-9a07-8544f461a907","China APT Uses AI Pentest Tool Artex in ConnectWise Attacks","china-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks-28839f","The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments. The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek.","A China-linked APT tracked as Storm-0940 has been leveraging the open-source AI penetration testing framework Artex to automate large-scale attacks against ConnectWise customers since mid-October 2026. The threat actor used Artex to accelerate reconnaissance, password spraying, and OAuth application abuse at machine speed, compromising over 300 Microsoft Entra tenants across eight organizations and attempting to sign into more than 2,250 tenants. By modifying application credentials, the attackers established persistent access to victim environments even after remediation efforts.","China-linked Storm-0940 APT uses AI pentest tool Artex to automate ConnectWise attacks targeting hundreds of orgs.","https:\u002F\u002Fwww.securityweek.com\u002Fchina-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2023\u002F02\u002FChina-Surveillence-Threat.jpg","2026-10-23T10:31:16+00:00","2026-10-23T12:00:13.032551+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Storm-0940","threat_actor",{"name":21,"type":22},"Artex","technology",{"name":24,"type":25},"ConnectWise","product",{"name":27,"type":25},"Microsoft 365",{"name":29,"type":25},"Microsoft Entra",{"name":31,"type":32},"Microsoft","vendor","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,49,54],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":55},{"id":56,"icon":35,"name":57,"slug":58},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[60],{"type":61,"value":21,"context":62},"malware","Open-source AI penetration testing framework abused by Storm-0940 to automate attacks at machine speed",[31,24,27],{"controls":65,"vendors":149},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":96,"name":97,"problem":98,"products":99},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":58,"name":125,"problem":126,"products":127},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[128,133,141],{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":129,"product_name":130,"url":131,"description":132},"falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"defused","Defused","\u002Fvendor-logos\u002Fdefused.png","defused-tf","Defused TF","https:\u002F\u002Fdefusedcyber.com\u002Fproduct\u002Ftf","Threat intelligence feed from honeypots Defused runs on several continents, showing which vulnerabilities attackers are exploiting right now, with payloads and indicators.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",[150],{"slug":151,"name":31,"logo_path":152,"roles":153},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[154],"reported_by",{"slug":156,"title":157,"body":158,"framework_refs":159,"framework_notes":167},"ai-powered-apt-exploits-oauth-misconfigurations-to-compromise-hundreds-of-entra-tenants","AI-Powered APT Exploits OAuth Misconfigurations to Compromise Hundreds of Entra Tenants","Storm-0940 weaponized the open-source AI penetration testing tool Artex to conduct machine-speed password spraying and OAuth application abuse against ConnectWise customers, overwhelming defenses that were designed for human-paced attacks. The attackers modified application credentials within compromised Entra tenants to establish persistent backdoors, meaning that even organizations that attempted remediation remained exposed. This incident highlights how AI-assisted offensive tooling dramatically compresses the attack timeline, leaving defenders little window to detect and respond before persistence is established. The abuse of OAuth applications as a persistence mechanism underscores the critical importance of hardening identity configurations and continuously auditing registered applications and their permissions.",[160,161,162,163,164,165,166],"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","CIS Control 6: Access Control Management","CIS Control 17: Incident Response Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1098: Account Manipulation","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":168,"NIST SP 800-53 SI-2: Flaw Remediation":169,"CIS Control 6: Access Control Management":170,"MITRE ATT&CK T1098: Account Manipulation":171,"CIS Control 17: Incident Response Management":172,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":173,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":174},"NIS2 requires incident handling and access control measures commensurate with the risk; the scale of tenant compromise across eight organizations indicates systematic gaps in both areas that NIS2 obligations would compel organizations to address.","Timely patching and hardening of ConnectWise platform configurations would have reduced the attack surface exploited by Storm-0940 before Artex-assisted reconnaissance could identify and leverage it at scale.","Restricting which identities can register or modify OAuth applications, and enforcing MFA, would have limited the attackers' ability to gain footholds and establish persistent backdoors across Entra tenants.","The attackers modified OAuth application credentials to maintain persistent access, which maps directly to this technique and highlights the need for alerting on any application credential changes within identity platforms.","Victims attempted remediation but attackers had already modified application credentials to survive it, demonstrating that incident response procedures must include OAuth application auditing as a mandatory remediation step.","A structured vulnerability management process covering identity platform misconfigurations and OAuth permission sprawl would have surfaced the exploitable conditions in Entra before the APT could abuse them.","Storm-0940 succeeded through password spraying and OAuth abuse; enforcing strong authentication controls and least-privilege application permissions directly addresses the initial access and persistence vectors used in this attack."]