Threat video1:00
ARTEX Pentest Abuse by Storm-0940: Analysis & Hunting
Leaked secrets are the fastest way into ARTEX intrusions run by Storm-0940 and VAPOR PANDA. Covers 9 detection rules, including a free Splunk SPL rule.
Read the full threat intel for ARTEX Pentest Abuse by Storm-0940: Analysis & Hunting →
Chapters
- 0:00The hook151,000+ failed sign-ins.
- 0:04The storyARTEX surfaced in July.
- 0:11Attack pathAttackers adopted ARTEX.
- 0:27AttributionAttributed to Storm-0940.
- 0:32Indicators of compromise25 indicators to hunt: 13 IPs, 1 IP range and 3 domains, and more.
- 0:39MITRE ATT&CK techniques20 ATT&CK techniques, from reconnaissance to command and control.
- 0:44Remediation5 steps now: Scan repositories, forks and full git history for secrets.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00151,000+ failed sign-ins.
0:05ARTEX surfaced in July.
0:06Storm-0940 hit eight organizations.
0:11Attackers adopted ARTEX.
0:13Leaked secrets were the fastest route.
0:15A cross-tenant spray hit eight organizations.
0:18Microsoft ties Storm-0940 to ConnectWise.
0:23Backdoored ARTEX images circulated.
0:27Attributed to Storm-0940. Confidence: medium.
0:3225 indicators to hunt: 13 IPs, 1 IP range and 3 domains, and more.
0:3920 ATT&CK techniques, from reconnaissance to command and control.
0:445 steps now: Scan repositories, forks and full git history for secrets.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.