Microsoft says China-aligned Storm-0940 used ARTEX AI agents to reach 2,250 tenants

What Microsoft disclosed

Microsoft Threat Intelligence reported on 21 October 2026 that Storm-0940, a China-state aligned actor, has used the agentic AI penetration testing framework ARTEX since as early as September 2026. Microsoft says the group automated attacks on hundreds of organisations in sectors from aerospace and defence to government, semiconductors and think tanks. Several attacks gave the actor privileged access to cloud infrastructure, in multiple cases less than three hours after initial targeting.

Microsoft also assesses that Storm-0940 was responsible for the recently disclosed compromise of ConnectWise's multi-tenant cloud backup application. ConnectWise published its first advisory on 16 October. Microsoft says the activity did not result from a compromise of, or vulnerability in, Microsoft systems or products.

How ARTEX sped up the attack

ARTEX is an open-source framework of LLM-driven agents, written in Go with a Next.js front end, that can use any AI model. It runs a penetration test from reconnaissance to data exfiltration with little human input and stores discovered assets and weaknesses in a graph. Microsoft says actors in several regions use it.

Between 10 and 14 October 2026, Storm-0940 infrastructure ran an automated password spray against 327 accounts at eight organisations, producing more than 151,000 failed logons and peaking at 2,900 failures a minute on 11 October; none succeeded. After taking control of ConnectWise application identities, the agents used the same IP range to authenticate to customer tenants through apps that already had permissions, and attempted sign-ins to more than 2,250 tenants. In some, they went on through Microsoft Graph to reconnaissance, application credential changes and attempts to change privileged roles, which can leave backdoors after the original app is fixed.

Who is affected and what to do

Organisations that installed or authorised the affected ConnectWise applications are the direct concern. Microsoft stresses that an affected app or even a successful sign-in does not by itself mean data was accessed. It advises keeping the ConnectWise connections disabled until ConnectWise gives restoration instructions, not deleting enterprise applications as a first step, preserving Entra and Purview audit logs, and reviewing service principal sign-ins from at least 15 October, ideally from 1 October. Teams should look for new app credentials, consent grants and privileged role assignments. More on AI-driven attacks is under Cybersecurity.

What to watch next

Microsoft does not say how many tenants saw data accessed or exfiltrated, and it does not name which AI models drove ARTEX in this campaign. The speed figures support a point other threat reports have made this autumn: defenders have far less time between alert and compromise when agents run the attack.

Questions people ask

What is ARTEX?

An open-source penetration testing framework made of LLM-driven agents that can use any AI model. Microsoft says it runs tests from reconnaissance to exfiltration with little human interaction, and threat actors in several regions use it.

Was Microsoft hacked?

No. Microsoft says the activity did not result from a compromise of or a vulnerability in Microsoft systems, products or services. The actor abused ConnectWise applications that customers had already granted access.

What should ConnectWise customers do?

Microsoft advises keeping affected app connections disabled, preserving logs before deleting anything, and reviewing service principal sign-ins and Entra audit records from at least 15 October 2026.

Sources

1. AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Microsoft Security Blog (Microsoft Threat Intelligence), 21 Oct 2026)