Microsoft 报告称中国关联组织 Storm-0940 使用开源 AI 智能体 Artex 自动化网络攻击
Microsoft 报告称，国家关联组织 Storm-0940 使用开源 AI 智能体 Artex，将多个 LLM 智能体串联，自动完成从侦察到数据窃取的渗透测试。
Microsoft published a new report saying that it has seen cyberattacks carried out by a Chinese state-aligned actor called Storm-0940, which used a Chinese AI agent named Artex to automate attacks aimed at hundreds of organizations worldwide in a broad range of industries.
ARTEX, released on GitHub as open source, chains LLM agents through a penetration test from reconnaissance to data theft with little human input.
The keys belonged to ConnectWise’s Microsoft 365 backup and management apps, already trusted with wide access, so signing in skipped user logins and MFA.
Several ARTEX-driven intrusions went from first targeting to privileged cloud access in under 3 hours.
Inside some tenants, the agents queried Microsoft Graph, added credentials to other apps and had a ConnectWise app grant itself Global Administrator.
Most targeting still failed, including a password spray that logged 151K+ failures without one success, and an app sign-in alone does not prove theft.
OAuth app abuse is old Storm-0940 tradecraft, but ARTEX ran it fast enough to leave defenders little time between alert and revocation.
来源：rohanpaul_ai · x.com