The Federal Bureau of Investigation warned IT administrators on Clubic that the ARTEX threat actor is targeting legacy IT infrastructure and partner portals.
Investigators found that the campaign exploits overlooked systems and forgotten internet-facing applications rather than core security perimeters. IT staff must inventory all internet-accessible applications and restrict connection privileges to absolute minimum operational requirements.
Organizations running or previously utilizing ConnectWise Cloud Backup must audit all Microsoft 365 accounts associated with the service. Administrators need to query applications by their unique identifiers rather than display names to uncover hidden installations.
Microsoft 365 Security Audit Requirements
Audits must cover access logs, failed connection attempts, and permission grants dating back to Oct. 1. Security teams should review the Entra directory for unauthorized credential additions, unknown application integrations, and unexpected role modifications.
The agency instructed administrators to leave existing ConnectWise integrations disabled pending formal restoration guidance. Teams should preserve the application state without immediate deletion to maintain complete forensic artifacts for the intrusion investigation.
Investigators also advised verifying published IP addresses before implementing network blocks, noting that threat actors frequently shift infrastructure between phases. In France, affected organizations and individuals can access technical guidance through the official cyberattack assistance platform.
Vulnerable systems and audit steps for ARTEX
What specific systems are most vulnerable to ARTEX?
The campaign targets forgotten or legacy network access points, including partner portals and outdated web services that lack active monitoring. IT professionals must map every perimeter application connected to the public internet.
How should administrators examine ConnectWise integrations?
Teams must search Microsoft 365 logs using the specific application identifier rather than its display name to detect hidden instances. The audit window must cover all activity and failed sign-in attempts since Oct. 1.
Should administrators delete disabled ConnectWise applications?
The FBI instructs organizations to leave the integrations disabled without deleting the software immediately. Preserving the current application state retains essential forensic logs for ongoing intrusion analysis.
Related reading