Microsoft attributes ConnectWise supply chain compromise to China-state aligned Storm-0940 using ARTEX AI

Microsoft attributes a multi-tenant ConnectWise application supply chain compromise to Storm-0940, a China-state-aligned threat actor that deployed the ARTEX agentic AI penetration testing framework against hundreds of organizations worldwide as early as September 2026. The actor used ARTEX to attempt more than 2,250 tenant sign-ins at 2,900 attempts per minute during the ConnectWise incident. Some Storm-0940 ARTEX attacks achieved privileged cloud access in under three hours from initial targeting.

Storm-0940 is a China-state aligned threat actor tracked by Microsoft since 2021 that targets organizations across multiple industries for data theft. Microsoft tracks the actor under no known industry aliases. The group historically gained initial entry through password spraying and attacks on internet-facing applications, then used compromised accounts to move inside targeted environments. In cloud settings, the actor maintained persistence by adding credentials to existing OAuth applications for email and data exfiltration through Microsoft Graph.

ARTEX is an open-source penetration testing framework that supports any AI model to automate offensive security workflows. The system operates as a multi-agent LLM built in GO using a Next.js frontend that defaults to English but supports Korean, Mandarin, Spanish, and Japanese. ARTEX agents conduct autonomous penetration tests spanning reconnaissance to data exfiltration with minimal human interaction, mapping discovered assets and vulnerabilities into a graph. Multiple threat actors from different regions use ARTEX to improve capabilities and increase attack tempo.

ARTEX launched in July 2026 for legitimate security testing and became closed-source in October 2026 after reported misuse. The framework was linked to data breaches affecting approximately 68,000 people at South Korean financial firms. More than 100,000 records from at least 16 South Korean financial firms have been confirmed leaked since earlier this month. Recorded Future and CrowdStrike attributed the South Korean incident to Chinese-speaking threat actors using ARTEX with multiple AI models.

Microsoft Threat Intelligence has found threat actors in multiple geographic regions using the ARTEX framework. Agentic AI integration lets threat actors scale operations exponentially and shortens the time from target selection to completion. ARTEX agents work continuously without human constraints such as weekends or holidays and can try multiple breach paths at once. The rapid rate leaves defenders limited time to detect and respond.

Storm-0940 applied ARTEX to speed up scanning, reconnaissance, password spraying, and OAuth application abuse against downstream ConnectWise victims. As early as September 2026, Storm-0940 deployed ARTEX to automate attacks against hundreds of organizations worldwide. From Oct. 10 to Oct. 14, 2026, Storm-0940 infrastructure at 144.172.64.99 ran a cross-tenant password spray against 327 accounts across eight organizations.

Microsoft recorded more than 151,000 failed logon events during the campaign, peaking at 2,900 failures per minute on Oct. 11. The campaign placed more than 111,000 failures in one day and generated more than 1,000 failures against 48 accounts. Lockout responses made up nearly 98 percent of all campaign activity.

The password spray produced no successful logins, token grants, Graph calls, or directory modifications. Most Storm-0940 targeting failed, but the actor gained persistent privileged cloud access at many organizations quickly.

During the ConnectWise incident, Storm-0940 used ARTEX to attempt more than 2,250 tenant sign-ins at 2,900 attempts per minute. After seizing multiple ConnectWise cloud application identities, AI agents acting for the threat actor logged into customer environments using stolen application credentials. The access did not require an interactive user sign-in. In some customer environments, AI agents moved past authentication into Microsoft Graph and directory operations.

The activity included reconnaissance, credential changes for persistence, and modifications to identities, groups, and privileged roles. Microsoft found follow-on activity in multiple customer environments showing a privileged third-party application can reach beyond its original purpose. Credential changes can maintain access across other identities, credentials, and cloud services and act as a backdoor after remediation.

Storm-0940 sought access to multiple tenant subscriber organization units through the trusted application identity instead of breaching individual companies separately. The targeting included aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. ConnectWise is a managed service provider that handles IT operations for small and medium-sized enterprises.

The ARTEX activity did not stem from a breach or vulnerability in Microsoft corporate systems, products, or services. Successful authentication or application presence alone does not prove customer data was accessed or stolen. Microsoft did not disclose how many customers were compromised.

Public reports of the ConnectWise compromise appeared on Oct. 15 with indicators matching the earlier password spray network range. ConnectWise issued an initial advisory on Oct. 16, 2026, and later expanded its disclosures and containment guidance. The advisory covered ConnectWise’s investigation of unauthorized access attempts tied to Cloud Backup. An Oct. 16 advisory included an indicator matching the 144.172.64.99 infrastructure from the earlier password spray campaign.

Related IP indicators are 144.172.64.60, 144.172.64.99, and 144.172.64.128. Microsoft listed four affected application IDs: 506e08f9-6e9a-4da4-942b-a099a03644ae, 24205314-2b89-4e07-a2a4-579e898a5640, 0de14c77-b9b0-4137-9360-34878a929827, and c921256f-04a7-44e8-9b2a-69c33929ba19. The affected applications are ConnectWise Cloud Backup, ConnectWise – MS Teams, ConnectWise – MS Graph, and SkyKick Partner Portal.

ConnectWise shut down services temporarily on Saturday and began phased restoration on Wednesday. ConnectWise advised customers to keep connections disabled and estimated recovery would take several days. ConnectWise said in a statement Friday it was “investigating recent unauthorized access attempts related to our cloud backup environment.”

Igor Tsyganskiy, executive vice president at Microsoft, wrote in a LinkedIn post Wednesday, “Since early October, a wave of AI-driven cyberattacks has been ongoing.” Microsoft recommends reviewing service principal sign-ins (sign-ins by automated application identities), investigating unexpected application credential or privilege changes, and following ConnectWise containment guidance while preserving evidence. Microsoft Defender XDR supplies detection rules and hunting queries targeting suspicious Microsoft Graph activity and known threat infrastructure.