The group behind last week's supply chain attack on Microsoft 365 tenants used an open-source hacking tool developed in China to compromise ConnectWise's OAuth app, according to Microsoft.
ARTEX is an AI penetration testing tool licensed under the AGPL, and it was used by a known hacking group called Storm-0940 "to automate attacks targeting hundreds of organizations globally across a broad range of industries," Microsoft said in a blog post Wednesday. Storm-0940 is "a China-state aligned actor," the company said, and it is known for launching password-spray attacks at US companies.
"Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours," Microsoft said.