Intel Exchange

An unattributed threat actor, possibly using AI-assisted automation, is abusing stolen Entra ID and Azure DevOps workload credentials to harvest secrets and move laterally across MSP client tenants.

Attackers give the open source ARTEX framework credentials and a goal. Its AI agents then run Active Directory enumeration, Kerberoasting, DCSync and cloud probing. Google tracks the activity as UNC7228, which overlaps Storm-0940.

China-state aligned actor Storm-0940 utilized the ARTEX agentic AI framework to automate a large-scale supply chain compromise targeting ConnectWise applications and downstream cloud environments.

The n0n ransomware group utilizes AI coding agents and credential-based access to target global organizations, frequently destroying data and backups when encryption is not feasible.

Threat actors Storm-3121 and Storm-3032 utilize passkey-themed social engineering and AiTM phishing to compromise Microsoft cloud identities for automated data exfiltration via Microsoft Graph.

Storm-3168 (JADEPUFFER) utilizes compromised service principals to automate resource discovery, destruction, and credential theft across Microsoft Azure environments.

ExfilSquad is a data extortion group targeting organizations by exploiting misconfigured Microsoft Power Pages portals to exfiltrate Dataverse records via public APIs.

The threat actor Storm-2755, also known as Payroll Pirates, uses adversary-in-the-middle (AiTM) phishing and residential proxies to compromise Microsoft 365 accounts for targeted financial data collection.

The threat actor JINX-0163, operating as FulcrumSec, targets cloud-native environments using exposed credentials and RCE vulnerabilities to exfiltrate data for ransom.

Vulnerabilities in Microsoft Graph API allow attackers to bypass Conditional Access policies and escalate token privileges to enumerate entire Entra ID tenants using compromised credentials.