View Ridge Security
Back to Cyber Hose

Storm-0940 uses ARTEX AI to attack 2,250+ Microsoft 365 tenants

Storm-0940 weaponized agentic AI via ConnectWise supply chain to hit 2,250+ Microsoft 365 tenants, plus Dahua camera hijacks and DarkSword spyware campaigns.

🚨 ACTIVE EXPLOITATION

  • Storm-0940 used ARTEX agentic AI to attack 2,250+ Microsoft 365 tenants via ConnectWise supply chain
    Microsoft attributed the ConnectWise supply chain compromise to China-aligned Storm-0940, which used the ARTEX agentic AI framework to attack more than 2,250 Microsoft 365 tenants.

    • Targets include ConnectWise Cloud Backup customers across aerospace and defense, financial services, government, energy, manufacturing, semiconductors, and other sectors.
    • Storm-0940, a China-state-aligned actor active since 2021, used stolen ConnectWise application credentials to authenticate as applications, bypassing interactive sign-ins and user MFA prompts.
    • The ARTEX open-source multi-agent LLM framework automated reconnaissance, password spraying, OAuth application abuse, and Microsoft Graph activity including credential changes and privileged role assignments.
    • Microsoft observed more than 2,250 tenants targeted at up to 2,900 sign-in attempts per minute; a preceding password-spray campaign logged 151,000+ failed logons against 327 accounts across eight organizations.
    • IOCs include IPs 144.172.64[.]128, 144.172.64[.]99, 194.165.16[.]21, 144.172.64[.]60, and user agents Python-urllib/3.12, curl/7.88.1, python-requests/2.31, and azure-toolkit/1.0.
      πŸ“„ https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ Β· πŸ“Ž https://cybersecuritynews.com/hackers-use-ai-agents/ Β· πŸ‘ via https://cybersecuritynews.com/hackers-use-ai-agents/, https://www.cryptika.com/hackers-use-ai-agents-to-target-over-2250-microsoft-365-tenants-through-connectwise/

  • 14,530+ Dahua IP cameras hijacked across Ukraine and Russia in Operation CameraSwarm
    A single operator compromised over 14,500 Dahua IP cameras, mostly in Ukraine and Russia, via serial-number guessing, credential brute force, and authentication-bypass exploits.

    • Targets are Dahua IP cameras, NVRs, and DVRs with active Easy4IP P2P functionality, including devices not directly exposed to the internet
    • Exploitation uses the CVE-2021-33044/CVE-2021-33045 authentication-bypass chain, credential brute force, and predictable Easy4IP serial numbers that allow brute-force enumeration of devices via Dahua's cloud relay without rate limits or lockouts
    • A persistent backdoor account (p2pwn / p2password) was installed over RPC on 1,923 cameras; it survives password changes and, on most firmware, factory resets
    • 283 cameras were reached by serial number alone through Dahua's cloud relay, with 89.4% of live serials requiring no authentication; offline recovery codes grant cloud-level admin access by serial number
    • Attacks scan TCP port 37777; IOCs include unknown accounts, unauthorized configuration changes, and DVRIP auth events from 127.0.0.1; a SalatStealer Windows infostealer was staged on the same operator host
      πŸ“„ https://www.dahuasecurity.com/about-dahua/trust-center/dahua-psirt/security-advisory-%E2%80%93vulnerability-found-in-some-dahua-products Β· πŸ“Ž https://hunt.io/blog/operation-cameraswarm-dahua-cameras-compromised Β· πŸ‘ via https://thehackernews.com/2026/10/attackers-hijack-dahua-ip-cameras-in.html

  • Malicious Instagram Ads Deliver DarkSword iPhone Spyware in 'Half-Click' Attacks
    Criminal groups are using malicious Instagram ads and hijacked website tags to deliver DarkSword and Coruna iOS exploit kits that spy on iPhones without any click.

    • Affects iPhone users on vulnerable, unpatched iOS versions; DarkSword supports iOS 18.4 through 18.7, with non-working placeholders targeting iOS 26 and 27.
    • DarkSword (P7 variant) and Coruna kits steal keychain passwords, messages, contacts, location data, and crypto wallets including Binance, Coinbase Wallet, OKX, Bitget, Trust Wallet, Exodus, TronLink, and Bitpie.
    • Infection is automatic when a malicious ad or page element loads β€” a malicious World Cup Instagram ad served from ad-track[.]live infected an employee's iPhone while scrolling, with no tap, download, or install required.
    • Report URI's 'DeadTag' operation exploits hundreds of re-registered expired analytics/ad domains still loaded by thousands of sites, exposing an estimated 135 million monthly visits; DarkSword loaders were also planted on hundreds of PrestaShop stores and a fake Polymarket page.
    • Chinese-language code comments suggest Chinese-speaking operators; financial theft appears to be the motive. Google GTIG separately reported DarkSword zero-days (CVE-2025-31277, CVE-2025-43529, CVE-2026-20700) used by multiple actors since November 2025, patched in iOS 26.3.
      πŸ“„ https://www.lookout.com/blog/darksword Β· πŸ“Ž https://www.iverify.com/blog/malvertising-coruna-darksword-iphone-exploits Β· πŸ‘ via https://cybersecuritynews.com/malicious-instagram-ads/, https://www.cryptika.com/hackers-use-malicious-instagram-ads-to-infect-iphones-with-spyware-without-a-click/

πŸ•΅οΈ RESEARCH & DEEP DIVES

  • OpenAI Codex finds backdoors and hardcoded keys in four USB encryption products
    OpenAI Codex helped researcher Xusheng Li break the encryption of four USB protection products in minutes.

    • Affects SecZure YutianDun, NetacFileLock, KakaSoft USB Copy Protection 5.6.0.299, and Nexcopy Copy Secure (Drive Wizard 1.0.81).
    • Flaws include hardcoded AES keys, hidden accounts with fixed passwords (Buffer/123456, System/SECZURE.COM), and keys not derived from the user password, enabling passwordless decryption.
    • Codex, paired with Binary Ninja's MCP server, found NetacFileLock's fixed 32-byte AES-256 key in seven minutes from a single prompt; KakaSoft and Nexcopy analyses took roughly 26 and 10 minutes respectively.
    • YutianDun also used MD5/HMAC-MD5 key derivation limiting AES keys to 64 bits of entropy; NetacFileLock logged passwords in plaintext and used ECB-style block encryption.
    • Researcher Xusheng Li published the findings on Binary Ninja's blog on October 22, 2026, without conventional coordinated disclosure.
      πŸ“„ https://github.com/xusheng6/breaking_encrypted_USB_drives_with_TTD/blob/main/Breaking_Encrypted_USB_Drives_v2.pdf Β· πŸ“Ž https://binary.ninja/2026/10/22/breaking-more-encrypted-usb-drives-with-ai.html Β· πŸ‘ via https://cybersecuritynews.com/openai-codex-breaks-usb-encryption-in-minutes/, https://www.cryptika.com/openai-codex-breaks-usb-encryption-in-minutes-exposing-hardcoded-keys-and-security-flaws/

  • Hackers abuse claude.ai Artifacts and Google Ads to spread AMOS and Windows infostealers
    Attackers hosted fake Claude download pages on claude.ai and promoted them via Google Ads to deliver the AMOS macOS infostealer and a Windows .NET payload.

    • Targets macOS and Windows users searching for Claude desktop app downloads; fake pages appear as sponsored search results.
    • Lures are user-generated Shared Chats or Artifacts on claude.ai with Claude branding, promoted via paid Google Ads (gclid, gad_campaignid tracking params).
    • macOS lure uses ClickFix: victims paste a scrambled Terminal command that installs Atomic macOS Stealer (AMOS), which steals passwords, browser sessions, crypto wallets, and files (.pdf, .docx, .key, .seed, .pem, .wallet, .ovpn), and swaps Ledger/Trezor apps with fake versions asking for recovery phrases.
    • Windows variant instructs Win+R, Ctrl+V, Enter to run a malicious PowerShell command that fetches an encrypted .NET payload from GitHub/github.io, hiding in a normal process, checking for antivirus, taking screenshots, and searching for Electrum, Exodus, Ethereum, Bitcoin, and Ledger wallets.
    • Identified by Gen Digital researchers including VojtΔ›ch Moravec in a report published October 26, 2026; multiple rotating Artifacts tied to two ad campaigns indicate a funded, ongoing operation.
      πŸ“„ https://www.gendigital.com/blog/insights/research/claude-content-sharing-malware Β· πŸ“Ž https://cybersecuritynews.com/claudes-official-website/ Β· πŸ‘ via https://cybersecuritynews.com/claudes-official-website/, https://www.cryptika.com/hackers-abuse-claudes-official-website-and-google-ads-to-spread-malware/

  • ICMacOS macOS malware sold for $699/week evolves from infostealer into persistent RAT
    The ICMacOS (Icarus) macOS malware-as-a-service, sold for $699 a week on Russian-speaking dark web forums, has evolved from a credential stealer into a persistent remote access trojan.

    • Targets macOS users, especially developers and executives, stealing browser passwords and cookies, crypto wallets, Keychain data, Telegram/WhatsApp/Discord data, and developer secrets like SSH keys, AWS/Kubernetes configs, Git credentials, and .env files
    • Sold by actor 'GlowComa' under the MADHASH crypto-draining affiliate group; Moonlock Lab calls it the most affordable macOS stealer on the dark web (AMOS ~$3,000/month, Banshee $1,500–$3,000/month)
    • Delivered via ClickFix-style fake web pages that trick users into pasting a Terminal command; a dropper hides the window, shows a fake System Preferences password prompt, validates it against the Keychain, then fetches an Apple Silicon or Intel payload
    • Version 2 adds a live WebSocket C2 channel allowing real-time /bin/sh command execution, plus persistence via a LaunchAgent named com.apple.systemupdater.plist that restarts the malware and reruns it every 60 minutes
    • It evades CIS-region systems by checking system language and IP geolocation; IOCs include domains escapeai[.]live and mikoblico[.]xyz, IPs 85.137.253[.]61 and 45.13.186[.]247
      πŸ“Ž https://cybersecuritynews.com/icmacos-remote-access-trojan/ Β· πŸ‘ via https://cybersecuritynews.com/icmacos-remote-access-trojan/, https://www.cryptika.com/hackers-sell-icmacos-remote-access-trojan-for-699-a-week-to-target-mac-users/

  • Three TLS bugs in GoAhead embedded web server allow revoked certs, session decryption, and chain-depth bypass
    FoxIO researchers disclosed three TLS bugs in the GoAhead embedded web server affecting hundreds of millions of IoT, firewall, OT, and military devices.

    • GoAhead is used in devices from Palo Alto Networks, Comcast, D-Link, HP, Canon, Honeywell, GE, Oracle, Siemens, Rockwell, Lockheed Martin, Boeing, and others
    • OpenSSL-compatible backend (GoAhead 3.4.5–6.1.0, CVSS 9.1, GOAHEAD-SA-2026-0006): CRL is loaded but X509_V_FLAG_CRL_CHECK is never set, so revoked client certificates are silently accepted in mTLS
    • Mbed TLS backend (GoAhead 4.0.2–6.1.0, CVSS 5.9, GOAHEAD-SA-2026-0005): a sizeof(dhm_g) typo passes a 1-byte length for the 2048-bit DH modulus, making TLS 1.2 DHE_RSA sessions decryptable
    • LibreSSL legacy verifier (CVSS 7.4, GOAHEAD-SA-2026-0004): with VERIFY_PEER=1 and VERIFY_ISSUER=0, an over-depth client certificate chain is accepted, bypassing the chain-depth limit
    • All bugs are fixed in GoAhead 6.1.1; PoC code is available in FoxIO's blog_poc repository
      πŸ“„ https://github.com/embedthis/goahead/security/advisories/GHSA-r392-vqwx-3r4g Β· πŸ“Ž https://foxio.io/blog/choose-your-backend-three-tls-bugs-in-goahead Β· πŸ‘ via https://www.reddit.com/r/netsec/comments/1xgjs4s/choose_your_backend_three_tls_bugs_in_goahead/

  • Researcher gains root access to 2025 Samsung Smart TV, uncovers extensive tracking features
    A researcher used zero-day exploits to root a 2025 Samsung Smart TV and documented extensive tracking capabilities in its Tizen firmware.

    • Applies to 2025 Samsung Smart TVs running Tizen firmware; findings not yet reproduced on an unmodified set and Samsung has not publicly responded.
    • Researcher 'log4j'

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check