Threat video1:00
ARTEX AI Pentest Framework Abuse: Analysis & Hunting
Storm-0940 abuses the ARTEX AI pentest framework against ConnectWise; 1,465 consoles are exposed. Includes 9 detection rules, one a free Splunk SPL rule.
Read the full threat intel for ARTEX AI Pentest Framework Abuse: Analysis & Hunting →
Chapters
- 0:00The hookCensys counted 1,465 exposed ARTEX consoles.
- 0:06The storyPublished on GitHub in July.
- 0:12Attack pathThe actor ran an ARTEX instance.
- 0:25AttributionAttributed to Storm-0940.
- 0:31Indicators of compromise18 indicators to hunt: 13 IPs, 3 IP ranges and 1 domain, and more.
- 0:38MITRE ATT&CK techniques18 ATT&CK techniques, from reconnaissance to command and control.
- 0:43Remediation5 steps now: Hunt for ARTEX consoles on your own and third-party-facing ranges.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Censys counted 1,465 exposed ARTEX consoles.
0:06Published on GitHub in July.
0:08Then it hit South Korean banks.
0:12The actor ran an ARTEX instance.
0:14It scanned, then sprayed passwords.
0:17Then ConnectWise identities were compromised.
0:20Google noted noisy trial and error: Kerberoasting.
0:25Attributed to Storm-0940. Confidence: medium.
0:3118 indicators to hunt: 13 IPs, 3 IP ranges and 1 domain, and more.
0:3818 ATT&CK techniques, from reconnaissance to command and control.
0:445 steps now: Hunt for ARTEX consoles on your own and third-party-facing ranges.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.