According to Microsoft, the China-aligned group Storm-0940 used the ARTEX framework to automate reconnaissance and exploitation across hundreds of organizations. In some cases, attackers moved from initial access to elevated cloud privileges in less than three hours. One operation targeting 327 accounts relied on a ConnectWise supply-chain compromise, followed by 2,900 sign-in attempts per minute and abuse affecting more than 2,250 tenants. Before this campaign, ARTEX was linked to data breaches affecting roughly 68,000 individuals at South Korean financial institutions. Microsoft recommends auditing third-party application permissions and monitoring service principal accounts, which often hold broad privileges.
Source: Read the original article
