This Week in Cybersecurity

Microsoft says China-linked Storm-0940 used Artex, an open-source AI penetration testing framework, to automate its mid-October intrusions into ConnectWise customer environments. Password spraying and OAuth app abuse have been Storm-0940 staples since at least 2021. Artex ran them at machine speed, firing more than 2,900 login attempts per minute and attempting sign-ins to more than 2,250 tenants. Where it got in, the AI agents pushed deeper on the attackers’ behalf. They mapped directories, swapped app credentials and made changes to identities, groups and privileged roles. Those credential swaps mean access can outlive cleanup of the original app. Zscaler’s teardown of the campaign even includes the group’s Claude Code prompt history. Audit service principal sign-ins against Graph and directory changes now, before assuming the incident is closed.