Microsoft says a China state-aligned hacking group used ARTEX, an open-source AI penetration testing framework, to compromise application identities belonging to IT services firm ConnectWise and then attempt sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts per minute. Microsoft Threat Intelligence and Microsoft Security Research published the findings on Oct. 21. In some cases, less than three hours passed between initial targeting and privileged access to a victim's cloud infrastructure.
Microsoft tracks the group as Storm-0940, an actor active since 2021 that targets organizations across industries for data theft. Microsoft says Storm-0940 began using ARTEX as early as September 2026 to automate attacks on hundreds of organizations worldwide, across aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, semiconductors, software, technology, and think tanks and non-profits.
ARTEX is a multi-agent LLM system written in Go with a Next.js frontend, and it can work with any AI model. It runs autonomous tests from reconnaissance through data exfiltration and builds a graph of the assets and vulnerabilities it discovers. The interface defaults to English and can be switched to Korean, Mandarin, Spanish, or Japanese. Microsoft says it has seen multiple threat actors in different regions using the framework, not only Storm-0940.
Key facts
- 01Microsoft attributes the ConnectWise supply chain compromise to Storm-0940, a China state-aligned group active since 2021.
- 02Using ARTEX, the group attempted sign-ins to more than 2,250 tenants at 2,900 attempts per minute.
- 03In some attacks, less than 3 hours passed between initial targeting and privileged cloud access.
- 04An Oct. 10-14 password spray hit 327 accounts at 8 organizations with 151,000+ failed logons and no successful sign-ins.
- 05Microsoft says the activity did not stem from a compromise of or vulnerability in its own systems.
Before the ConnectWise pivot, Microsoft observed a password spray campaign from Oct. 10 to Oct. 14 that targeted 327 accounts across eight organizations and produced more than 151,000 failed logons. Activity peaked on Oct. 11 at 2,900 failures per minute, with more than 111,000 failures in a single day. Microsoft saw no successful authentication from that campaign.
The group then shifted to ConnectWise. After gaining control of identities for several ConnectWise cloud applications, the attacker's agents used those trusted apps to authenticate to customer tenants without any interactive user sign-in. In some environments the agents moved on to Microsoft Graph operations, including reconnaissance, application credential changes for persistence, and changes to identities, groups, and privileged roles. Microsoft states the activity did not result from a compromise of or vulnerability in its own systems or products.
ConnectWise investigated the incident in an advisory issued Oct. 16 and later expanded it. The company shut down its Cloud Backup, SaaS Security, and Cloud Management services after discovering unauthorized access to application identities, and says it has contained the affected application connections and is restoring services in phases. ConnectWise CEO Manny Rivelo attributed the attack in a separate statement.
“it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup”— Manny Rivelo, CEO of ConnectWise
Rivelo also cautioned that containment on the ConnectWise side does not clean up customer environments. Access already established within individual customer tenants requires separate review, according to the company.
“those actions do not remove unauthorized access that may have already been established”— Manny Rivelo, CEO of ConnectWise
Microsoft has not disclosed how many customers were compromised or whether data was stolen. Most of the targeting failed, but Microsoft says Storm-0940 established persistent privileged access at numerous organizations. The company also cautions that an affected application or a successful authentication does not by itself show that customer data was accessed or exfiltrated.
Microsoft's guidance for affected customers is to keep ConnectWise connections disabled until ConnectWise issues formal restoration instructions, preserve Entra sign-in and audit logs before deleting anything, and review activity from at least Oct. 15, with service principal sign-in review extended back to Oct. 1. Only after evidence is preserved should teams revoke unnecessary permissions, rotate credentials, and remove unauthorized grants and identities.
ARTEX has also recently been linked to attacks on South Korean financial institutions and on Japanese companies across several sectors. The Chinese Embassy in Washington did not immediately respond to a request for comment, and Beijing regularly denies conducting or condoning cyber-enabled data theft.
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
