// Microsoft 365HIGH
Threat actors, including a China-linked group tracked as STORM-0940/UNC7228, are exploiting the open-source ARTEX AI agent framework to automate attacks against Microsoft 365 tenants using stolen ConnectWise credentials. ARTEX performs reconnaissance, credential theft through Kerberoasting, and lateral movement via Active Directory manipulation at machine speed—achieving deep system access in under 15 minutes in some cases. The framework chains standard Windows administrative techniques but executes them at scale with minimal human intervention, trading stealth for speed and leaving detectable audit logs.
// Get alerts for Microsoft 365