Threat video1:00
Storm-0940 ARTEX AI Intrusions: Detection & IOCs
Storm-0940 and VAPOR PANDA automate cloud intrusions with the ARTEX AI framework; includes 9 detection rules (one free in Splunk SPL) and 28 IOCs.
Read the full threat intel for Storm-0940 ARTEX AI Intrusions: Detection & IOCs →
Chapters
- 0:00The hookAI pentesting framework abused globally.
- 0:04The storyTwo APT groups weaponized the framework.
- 0:10Attack pathARTEX agents spray credentials across tenants.
- 0:23AttributionAttributed to Storm-0940.
- 0:28Indicators of compromise19 indicators to hunt: 11 IPs, 3 domains and 2 SHA-256 hashes, and more.
- 0:37MITRE ATT&CK techniques24 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation4 steps now: Inventory and disable ConnectWise Cloud Backup / Cloud Management app.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00AI pentesting framework abused globally.
0:05Two APT groups weaponized the framework.
0:11ARTEX agents spray credentials across tenants.
0:14ConnectWise identities grant admin access.
0:17Key Vault secrets and Graph data harvested.
0:23Attributed to Storm-0940. Confidence: medium.
0:2919 indicators to hunt: 11 IPs, 3 domains and 2 SHA-256 hashes, and more.
0:3824 ATT&CK techniques, from reconnaissance to command and control.
0:434 steps now: Inventory and disable ConnectWise Cloud Backup / Cloud Management app.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.