Microsoft said on Wednesday that a China-state aligned hacking group used an open-source agentic AI penetration-testing framework called ARTEX to automate a cyberattack campaign targeting hundreds of organizations worldwide, and attributed the recent supply-chain compromise of IT services firm ConnectWise’s Cloud Backup product to the same group.

The company, which tracks the group as Storm-0940, said in a Microsoft Security blog post published on October 21 that the actor has been using ARTEX since as early as September 2026. Several of the ARTEX-driven attacks gave Storm-0940 privileged access to an organization’s cloud infrastructure, in some cases less than three hours after the initial targeting.

What Was Announced?

Microsoft Threat Intelligence laid out the campaign in a detailed blog post on October 21. Storm-0940 is a China-state aligned actor, with no known industry aliases, that Microsoft has tracked since 2021. The group has historically gained initial access through password spraying and the exploitation of internet-facing applications, and in cloud environments it has established persistence by adding credentials to existing OAuth applications.

Microsoft infographic showing the scale of the Storm-0940 ARTEX campaign

Image: Microsoft.

After gaining unauthorized access to ConnectWise’s Cloud Backup service, the group used ARTEX to accelerate attacks on downstream victims. Microsoft said Storm-0940 used the framework to attempt sign-ins to more than 2,250 Microsoft 365 tenants at a rate of 2,900 sign-in attempts per minute, “a pace that leaves defenders with little time to detect and respond.”

The scale figures are striking. Between October 10 and 14, Storm-0940 infrastructure conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online. Microsoft telemetry captured more than 151,000 failed logon events during that window, with activity peaking on October 11 at 2,900 failures per minute and concentrating more than 111,000 failures into a single day. Forty-eight accounts received more than 1,000 failures each, and lockout responses represented nearly 98% of all activity. In that particular spray, Microsoft observed no successful authentication.

But the broader campaign was not limited to password spraying. After acquiring control of the identities of multiple ConnectWise cloud applications, the AI agents operating on behalf of Storm-0940 authenticated to customer environments using the stolen app credentials, exploiting the trust those apps already held inside each tenant. Microsoft observed follow-on activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access. Microsoft noted that such credential and privilege changes “can remain active as a backdoor even after the original compromised application is mediated.”

Key figures of the Storm-0940 ARTEX campaign

Graphic: GPTOnline, using Microsoft assets.

The targeting spanned aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks, and nonprofits. Microsoft said the majority of the targeting was not successful, but that Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.

ConnectWise published an initial advisory on October 16 saying it was “investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment.” In an October 21 update, ConnectWise said that “based on the evidence available to ConnectWise, including threat intelligence shared by Microsoft, it appears that a China state-aligned group was responsible.” Microsoft assessed that Storm-0940 was responsible for the supply-chain compromise of the multi-tenant application.

What Is ARTEX?

ARTEX is described by Microsoft as “an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows.” The framework is a multi-agent LLM system written in Go with a Next.js frontend. Microsoft wrote:

“ARTEX is a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.”

The interface and generated output default to English but can be switched to Korean, Mandarin, Spanish, or Japanese. Microsoft said it has identified threat actors across multiple geographic regions using the framework, and noted that October 2026 public reporting linked ARTEX to personal data breaches targeting Korean financial institutions.

Why It Matters

The central warning in Microsoft’s disclosure is about speed. In its own words: “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially.”

Microsoft elaborated:

“Agents are not constrained by factors affecting humans, they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises.”

As the company put it: “Storm-0940’s activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organizations.”

For defenders, the practical takeaways are urgent. Microsoft recommends that organizations keep affected ConnectWise application connections disabled until ConnectWise provides formal restoration instructions, inventory the four application IDs listed in its report, review every Microsoft 365 tenant where the affected applications were installed or authorized, and review activity starting from at least October 15. It also advises reviewing service-principal sign-ins and Microsoft Entra audit records for unexpected credential or privilege changes, and preserving evidence before removing anything.

Microsoft also cautioned that the activity “did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services,” and that the presence of an affected application, or even successful threat-actor authentication, “does not necessarily indicate that customer data was accessed or exfiltrated.”

Sources