Microsoft says China-linked Storm-0940 used AI tool ARTEX against ConnectWise

Microsoft attributed the campaign to Storm-0940, a China-linked threat actor it has tracked as active since at least 2021. The group used the agentic AI penetration testing framework ARTEX to compromise Microsoft 365 environments belonging to ConnectWise Cloud Backup customers on Oct. 15. The incident involves managed service providers and their clients across multiple sectors.

ARTEX is an open-source multi-agent LLM system that can use any AI model, Microsoft said. The framework automates penetration testing tasks and was released in July 2026 for legitimate security testing. Its developer took ARTEX closed-source on Oct. 8 after researchers linked it to attacks on South Korean banks. Microsoft noted that several hacking groups now use ARTEX.

Before the ConnectWise attack, ARTEX was linked to data breaches affecting roughly 68,000 individuals at South Korean financial institutions. Previous reporting by CrowdStrike, Zscaler, and Recorded Future linked AI-powered activity to attacks targeting those institutions, according to Microsoft’s report. Zscaler published a technical deep-dive into Storm-0940’s AI-assisted attacks, including ARTEX configurations, synchronization scripts, a Claude Code prompt history, and network routing tools.

Microsoft reports that Storm-0940 targets organizations in multiple sectors using password spraying and exploits against vulnerable internet-facing applications. The actor has been tracked as active since at least 2021.

Microsoft said Storm-0940 used Artex to automate attacks on hundreds of organizations globally starting in September 2026. The agency also described one operation from Oct. 10 to 14 that targeted 327 accounts using Artex.

Microsoft reported that Storm-0940 attempted sign-ins to more than 2,250 tenants at a rate of 2,900 sign-in attempts per minute. The company captured more than 151,000 failed logon events associated with the attacks and observed successful authentication using the identities of many ConnectWise cloud applications.

Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute

Microsoft, Silicon UK

Huntress observed attackers using compromised ConnectWise application credentials to access hundreds of Microsoft 365 tenants, including over 300 Entra tenants. As of Oct. 17, Huntress confirmed unauthorized logins in 173 tenants and said the real figure is likely higher.

In some environments, AI agents acting for Storm-0940 moved beyond authentication to Microsoft Graph and directory operations. Microsoft said the activity covered reconnaissance, moves to change application credentials to establish persistence, and adjustments to identities, groups, and privileged roles. Microsoft warned that changing application credentials creates persistence that can remain active as a backdoor even after administrators remediate the affected application.

In some incidents, Storm-0940 moved from initial foothold to elevated cloud privileges in less than three hours, according to Microsoft. Microsoft said most of the targeting did not succeed, yet Storm-0940 still gained privileged cloud persistence at many organizations quickly.

Microsoft said the activity did not stem from a compromise or flaw in Microsoft systems, products, or services. The company noted that successful authentication or the presence of an affected application does not necessarily show unauthorized data access or data exfiltration. Microsoft has not said how many organizations experienced a breach and reiterated that a login does not always mean data theft.

ConnectWise publicly acknowledged the breach on Oct. 16 and published an initial advisory covering attempted unauthorized access associated with its Cloud Backup product. The company suspended Cloud Backup, SaaS Security, and Cloud Management services in response to the attack.

ConnectWise turned off Cloud Backup on Oct. 17, then reset every account and credential in the affected environment on Oct. 19. The company said there is no sign backup data was taken. ConnectWise said on Wednesday it was beginning the restoration process and was preparing a phased restoration expected to take several days once it begins.

ConnectWise provides software to managed service providers, and its backup tool can access customer e-mail, files, and Teams data. Igor Tsyganskiy, a Microsoft executive vice president, described the ConnectWise attack as part of a wave of AI-driven attacks that began in early October.

Yih Khai Wong of IDC Asia/Pacific said 2,900 sign-in attempts per minute and privileged cloud access in under three hours is beyond human analyst queues. “relying on a human to click ‘approve’ will not cut it,” Wong said. He added that containment actions should trigger automatically on predefined thresholds, with humans reviewing them afterward.

Wong said ConnectWise and customers share accountability: ConnectWise must protect the credentials and infrastructure that allow its app to reach across tenants, while customers must know what access they granted and to whom, and for what period. Vicky Sheridan of AXA XL said, “We’re also seeing growing exposure to cyber risks arising from third-party technology providers.”

Yash Kadakia of Security Brigade said enterprises should treat vendor integrations like privileged accounts. Kadakia said vendor integrations should carry minimal permissions, undergo continuous monitoring, receive periodic access reviews, and include a tested method to revoke access. Kadakia noted that defenders cannot reliably tell an AI agent from a human operator by examining individual requests, and advised focusing on what the identity is doing rather than who controls it.

Microsoft said organizations should review service principal sign-ins together with later Microsoft Graph activity, directory changes, and resource access, matching suspicious events against authorized administrative activity. The company urged a review of activity from at least Oct. 15 extending back to Oct. 1 where records allow. Microsoft said organizations should look up tenants using the four affected application IDs instead of display names and keep Entra, Purview, and SIEM records. Microsoft’s report includes indicators of compromise and Defender detections intended to help organizations catch similar activity.

Microsoft told customers not to delete enterprise applications right away and to keep affected ConnectWise connections turned off until ConnectWise issues restoration instructions. The immediate checklist includes auditing third-party apps with OAuth permissions and monitoring service principal activity for unusual volume, treating sudden bursts of authentication attempts as an alarm.