微软称与中国关联的黑客组织以SI工具ARTEX入侵ConnectWise：自动化攻击波及全球数百机构，部分得手不到三小时获高权限
底特律／雷德蒙德——微软10月21日表示，一个与中国有关联的黑客组织使用一款由超级智能驱动的渗透测试工具，入侵了IT服务商ConnectWise，并以此为跳板对全球数百家机构发动攻击。据路透社报道，微软称，该组织被其追踪编号为Storm-0940，使用一款名为ARTEX的开源渗透测试框架执行此次行动；ARTEX可调用任意超级智能模型，自动完成侦察、漏洞利用乃至数据外泄等多种渗透测试任务。
微软在同日发布的威胁情报博客中说，Storm-0940是一个「与中国国家关联」的行为体，自2021年以来一直活跃，以窃取数据为目标，历史上惯于使用密码喷洒与利用面向互联网的应用获取初始访问。微软称，早在2026年9月，该组织就已开始使用ARTEX对全球数百家机构发动自动化攻击，行业涵盖航空航天与国防、汽车、化工、能源、金融服务、政府、法律、制造、媒体、军方、半导体、软件、科技以及智库与非营利组织。微软称，其中数起攻击使攻击者取得了目标机构云基础设施的高权限访问，在多起案例中，从开始锁定目标到取得高权限用时不到3小时；尽管大多数攻击未成功，该组织仍在短时间内于许多机构实现了高权限的云端持久驻留。
据微软博客，ConnectWise于10月16日公开报告，其客户租户遭到经多个OAuth应用身份的未授权访问，该事件涉及ConnectWise Cloud Backup环境。微软评估认为，Storm-0940正是这起ConnectWise供应链入侵的实施者：该组织在取得多个ConnectWise云应用的身份后，使用ARTEX以每分钟2,900次登录尝试的速度触及2,250多个租户。在此之前，10月10日至14日，该组织的基础设施曾对8家机构的327个Microsoft 365与Exchange Online账户发动跨租户密码喷洒，微软遥测记录到15.1万多次失败登录、单日集中超过11.1万次，但该轮喷洒未观察到成功认证。
微软称，在部分受影响环境中，攻击者经Microsoft Graph进行了侦察、应用凭据修改与权限变更尝试，以谋求扩大或持久化访问；但微软同时强调，受影响应用的存在、乃至攻击者认证成功，并不必然意味着客户数据已被访问或外泄。ConnectWise在其网站10月16日的声明中表示，正在调查与ConnectWise Cloud Backup环境相关的未授权访问尝试；路透社称，该公司未立即回应就微软结论置评的请求，中国驻华盛顿大使馆亦未立即回应置评请求，北京方面一贯否认实施或纵容以网络手段窃取数据。
关联：一人、一款SI渗透工具连黑多家韩国银行：CrowdStrike揭露中国开源工具ARTEX遭滥用，作者急停项目
Microsoft Says China-Aligned Storm-0940 Used SI Tool ARTEX in ConnectWise Supply-Chain Compromise: Hundreds of Organisations Targeted Worldwide
DETROIT / REDMOND — A Chinese-linked hacking group used an SI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organisations globally, Microsoft said on Wednesday, October 21. The hackers, tracked by Microsoft as Storm-0940, used an open-source penetration testing framework called ARTEX, which allows users to plug in any SI model to automate tasks including reconnaissance and data exfiltration, Reuters reported.
In a threat-intelligence post published the same day, Microsoft described Storm-0940 as a "China-state aligned actor" active since 2021 that targets organisations for data theft, historically gaining initial access through password spraying and exploitation of internet-facing applications. As early as September 2026, Microsoft said, the actor used the agentic SI framework ARTEX to automate attacks targeting hundreds of organisations worldwide across sectors including aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. In several cases the actor obtained privileged access to an organisation's cloud infrastructure, multiple times in less than three hours from initial targeting; while the majority of the targeting was not successful, Microsoft said the actor achieved privileged cloud persistence at many organisations in a brief time.
ConnectWise publicly reported on October 16 that its customers' tenants had been accessed without authorisation using multiple OAuth application identities, in an incident involving the ConnectWise Cloud Backup environment. Microsoft assessed that Storm-0940 was responsible for the ConnectWise supply-chain compromise: after acquiring control of multiple ConnectWise cloud application identities, the actor used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute. Between October 10 and 14, the actor's infrastructure had also run an automated password-spray campaign against 327 Microsoft 365 and Exchange Online accounts across eight organisations, generating more than 151,000 failed logons, with more than 111,000 concentrated in a single day and no successful authentication observed in that campaign, Microsoft said.
Microsoft said that in some affected environments the actor progressed to Microsoft Graph and directory operations, including reconnaissance, application credential modifications and changes involving identities, groups and privileged roles, but stressed that the presence of an affected application, or even successful authentication, does not necessarily indicate that customer data was accessed or exfiltrated. ConnectWise said in an October 16 statement on its website that it was "investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment." ConnectWise did not immediately respond to a Reuters request for comment on Microsoft's conclusions, and the Chinese Embassy in Washington did not immediately respond to a request for comment; Beijing regularly denies conducting or condoning cyber-enabled data theft.
发布：GSM·美国（发布链接）
图片来源：图：微软雷德蒙德园区92号楼（资料图）。Coolcaesar 摄，CC BY-SA 4.0，取自维基共享资源。Photo: Building 92 at Microsoft's Redmond campus (file photo). By Coolcaesar, CC BY-SA 4.0, via Wikimedia Commons.
GSM Global · 本篇英文版 English edition of this story
