cyber.hendryadrian.com
Security News · darkreading.com

Threat Actors Repurpose AI Pen-Testing Tool Artex for Automated Attacks

· Original article ↗

Summary

Multiple threat actors have repurposed the open-source AI penetration-testing framework Artex. Reported campaigns include credential attacks and downstream cloud compromises; its creator removed the original repository, but forks remain.

Key points

  • Artex can automate activities including password brute-forcing, database dumping, and API enumeration and abuse.
  • Microsoft observed an AI agent move from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes.
  • Storm-0940 reportedly used Artex in a password-spraying and credential-stuffing campaign targeting more than 300 accounts at eight organizations, making over 151,000 authentication requests.
  • The article reports that Storm-0940 then targeted ConnectWise infrastructure and exfiltrated trusted OAuth application credentials, which were used to compromise more than 2,250 downstream Microsoft 365 and Azure environments.
  • Microsoft said Cambodia-based Storm-3358 used Artex alongside conventional tools to scan internet-connected systems, exploit vulnerabilities, and install open-source remote access Trojans.
  • Other reported activity includes use by Vapor Panda and a GitGuardian lab test in which Artex found eight of nine secrets in runs where it acted.
  • Artex's creator removed the original GitHub repository in October, but forks remain. The article cites recommendations including MFA, credential hygiene, and hardening exposed systems and APIs.

Article Details

Event Type
Malicious use of Artex, an open-source AI penetration-testing framework, by multiple threat actors.
Impact
Reported activity includes password-spraying and credential-stuffing campaigns, vulnerability exploitation, credential theft, persistence, and data exfiltration. Storm-0940 reportedly used Artex against more than 300 user accounts at eight organizations, making over 151,000 authentication requests. After that effort largely failed, attackers reportedly stole trusted OAuth application credentials associated with ConnectWise Cloud Backup and compromised more than 2,250 downstream Microsoft 365 and Azure environments. Microsoft also reported Artex use by Storm-3358 against financial organizations, while other actors reportedly used it to compromise web applications, servers, and cloud identities.

MITRE ATT&CK

T1110.003 · Password SprayingStorm-0940 reportedly used Artex in a password-spraying campaign against user accounts.T1110.004 · Credential StuffingThe article reports credential-stuffing activity by Storm-0940 using Artex.T1505.003 · Web ShellMicrosoft reported that other threat actors used web shells for persistence on compromised web servers.

People

Autumn-27Independent developer who published the open-source Artex penetration-testing framework.Guillaume ValadonHead of cybersecurity research at GitGuardian; discussed the organization's sealed-lab testing of Artex and its handling of secrets.Matt SnyderAviatrix head of security operations and threat research who commented on Artex deployment security and operational discipline.Silas CutlerCensys principal security researcher who commented on defensive fundamentals in response to Artex activity.Steve WinterfeldAkamai advisory CISO who commented on how AI-enabled tools can accelerate and coordinate attacks.

Threat Actors

Storm-0940The article reports that Storm-0940 adapted Artex source code for its offensive infrastructure and used the framework in a password-spraying and credential-stuffing campaign, followed by activity targeting ConnectWise infrastructure.Storm-3358Microsoft reportedly observed this financially motivated, Cambodia-based threat cluster using Artex alongside conventional tools to scan internet-connected systems, exploit vulnerabilities, and install remote access Trojans, primarily against financial organizations in Southeast Asia.VAPOR PANDACrowdStrike reportedly connected Artex-powered espionage activity to the threat actor it tracks as Vapor Panda.

Vendors

ConnectWiseWhen this largely failed, Storm-0940 pivoted to target ConnectWise's internal infrastructure. Attackers exfiltrated trusted OAuth application credentials belonging to ConnectWise's Cloud Backup application, allowingMicrosoftMicrosoft saw an AI agent move from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes, for example.

Products

Azure Key VaultMicrosoft saw an AI agent move from scanning GitHub for secrets to exfiltrating data from an Azure Key Vault in five minutes, for example.ConnectWise Cloud Backupinfrastructure. Attackers exfiltrated trusted OAuth application credentials belonging to ConnectWise's Cloud Backup application, allowing them to compromise more than 2,250 downstream Microsoft 365 and AzureMicrosoft 365 Apps for Enterpriseto ConnectWise's Cloud Backup application, allowing them to compromise more than 2,250 downstream Microsoft 365 and Azure environments within three hours of initial targeting.

Tools

ARTEXAI penetration-testing tool Artex has proven to be a boon for threat actors large and small, taking familiar attacker playbooks and deploying them at machine speeds — ushering in a potentially new era for defenders

Countries

Cambodiaactor or objective. Microsoft last week published a blog post discussing how a financially motivated Cambodia-based threat cluster tracked as Storm-3358 started using Artex in its attacks against financialChinaThe best-known incident to date involved China's Storm-0940, which adapted Artex source code into its own offensive infrastructure. Last month, around Oct. 10, the actor used the Artex framework to launch a massive

Related Articles