← All stories

AI security

Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX

By Security Affairs1 min read

Microsoft has attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned group that used the open-source AI-driven penetration testing framework ARTEX to target 2,250 Microsoft 365 tenants.

Cover for a ai-security story

Microsoft has published a detailed technical report attributing the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a threat group it assesses to be aligned with the Chinese state, according to Security Affairs.

Per the report, the group leveraged ARTEX, an open-source AI-driven penetration testing framework, to conduct its operations. The use of an AI-powered tool allowed the attackers to operate at machine speed, automating phases of the intrusion that would traditionally require manual effort by human operators.

According to Microsoft's findings, Storm-0940 exploited stolen ConnectWise credentials to gain access and ultimately targeted 2,250 Microsoft 365 tenants. The incident is described as a supply chain compromise, meaning the attackers abused ConnectWise's Cloud Backup infrastructure as an entry point to reach downstream customer environments rather than attacking each tenant directly.

The case highlights a growing trend in which state-aligned threat actors adopt artificial intelligence tooling to accelerate and scale their campaigns. By pairing legitimately available offensive security frameworks with stolen credentials, attackers can significantly reduce the time between initial access and broad exploitation across many targets.

Microsoft's report provides technical detail on the group's tactics, techniques and procedures, offering defenders insight into how the campaign was executed. The findings were reported by Security Affairs, which noted that the attacks were carried out at machine speed thanks to the AI-driven framework. Organizations relying on ConnectWise Cloud Backup and Microsoft 365 are advised to review the technical indicators in Microsoft's report and assess their exposure.

Source: Security Affairs

Cover for a ai-security story

AI security

Apple Adds Setting to Exclude Apps from Siri AI, EFF Says

Apple's latest device update, iOS 27.2, introduces a setting that lets users exclude apps from Siri AI features, according to the Electronic Frontier Foundation, which says the change addresses a request from its Encrypt It Already campaign.

1 min read

AI-written summary Source: EFF Updates · Fetched

Cover for a ai-security story

AI security

Unit 42 Warns of Peak Season Cyber Threats Targeting Retailers

Unit 42 has outlined the key cyber threats facing retailers during the peak shopping season, ranging from ransomware to attacks involving artificial intelligence, along with guidance on defending operations and customer trust.

1 min read

AI-written summary Source: Unit 42 · Fetched

Cover for a ai-security story

AI security

GitHub's npm package firewall can block brand-new versions before they install

GitHub has announced a package firewall for npm that checks packages against an enterprise's policy before they install, blocking known malware, critical vulnerabilities and brand-new versions, Help Net Security reported. The checks run before a package reaches a developer's laptop, a build or a coding agent.

1 min read

AI-written summary Source: Help Net Security · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.