Microsoft links Storm-0940 to ConnectWise attack, ARTEX automation

Storm-0940 has been active since 2021, targeting a wide range of industries to steal data, according to Microsoft. The group began using ARTEX around September, and the framework's language options include Japanese, Korean, Chinese and Spanish in addition to English.

The ConnectWise case shows how the group operates: it stole credentials for apps such as ConnectWise Cloud Backup and abused permissions already granted to those apps in customers' Microsoft 365 environments. Attackers attempted sign-ins to more than 2,250 tenants at a rate of 2,900 per minute, and in some environments they gathered information, added new credentials to apps and granted admin rights. Microsoft said its own systems and products were not exploited, and that signs of intrusion do not necessarily mean data was viewed or taken.

Separately, GMO Cybersecurity by Ierae said on October 19 that it confirmed ARTEX abuse in unauthorized access targeting Japanese companies, with about 20 targeted and eight disclosing breaches in September-October. Microsoft said ARTEX users operate in multiple regions and did not address any link between those attacks and Storm-0940.