144.172.64[.]99IP address
Reported by 3 independent sources · first reported by The Hacker News · last reported
Last reported 2 days ago
What the reports say
4 reports, newest first · the exact sentence from each-
Microsoft Links ConnectWise Breach to China-Linked Group Using AI Pentesting Tool ARTEX“The attack came from the IP address 144.172.64[.]99.”
-
China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack“"Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online," Microsoft said.”
-
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise“Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online.”
-
ConnectWise Resets Credentials as Cloud Backup Remains Offline After Security Incident“144.172.64[.]99 - Failed user password spray, concentrated (October 10 to 14, 2026)”
Indicators reported together
named in the same reports- 144.172.64[.]128in 2 reports
- 144.172.64[.]60in 2 reports
- 144.172.94[.]243in 1 report
- 187.15.88[.]186in 1 report
- 187.15.90[.]217in 1 report
- 187.15.89[.]186in 1 report
Copy these 6 indicators · defanged
Thanks — we review every report.