China-linked Storm-0940 uses ARTEX AI agents in ConnectWise supply chain attack

Microsoft disclosed on Wednesday that a China state-aligned threat actor, tracked as Storm-0940, compromised the ConnectWise Cloud Backup application to launch a widespread supply chain attack. The adversary leveraged ARTEX, an agentic AI penetration testing framework, to automate reconnaissance and credential abuse against hundreds of organizations globally starting in September 2026.

What happened

Storm-0940 utilized the Go-based ARTEX framework to accelerate its offensive operations, operating at what Microsoft described as "machine speed." The campaign targeted a diverse range of sectors, including aerospace, defense, energy, financial services, government, and technology. By abusing trusted OAuth applications within the ConnectWise ecosystem, the attackers authenticated to customer environments without requiring interactive user sign-ins. This method allowed them to bypass traditional detection mechanisms that rely on monitoring human-like login patterns.

The scale of the automated assault was significant. Between October 10 and October 14, 2026, infrastructure associated with Storm-0940 conducted a cross-tenant password-spray campaign. During this period, the attackers targeted 327 accounts across eight organizations, generating over 151,000 failed logon events. The activity peaked on October 11, with 2,900 sign-in attempts per minute, resulting in more than 111,000 failures in a single day. While no successful authentications were detected during this initial spray phase, the sheer volume highlighted the aggressive nature of the automated probing.

On October 15, 2026, the tactics shifted as the AI agents successfully accessed identities of multiple ConnectWise cloud applications. Using these stolen credentials, the agents authenticated to customer environments by exploiting the existing trust relationships between the backup service and client tenants. In several instances, the time from initial targeting to achieving privileged access was less than three hours. Once inside, the agents performed reconnaissance, modified application credentials to establish persistence, and altered privileges for identities, groups, and roles within Microsoft 365 environments.

How it works

ARTEX is an agentic AI framework that enables autonomous decision-making during penetration testing. Unlike traditional scripts that follow rigid, pre-defined paths, ARTEX uses large language models to plan and execute complex attack chains. In this incident, the framework was configured to use DeepSeek models via an OpenAI-compatible gateway, though other configurations included GLM and Grok. The system employed a multi-agent architecture where different AI models divided tasks and reviewed each other’s findings. For example, prompts instructed GLM to audit work performed by DeepSeek subagents, ensuring higher accuracy in exploit selection and execution.

The framework’s ability to operate continuously without fatigue allowed Storm-0940 to test multiple breach paths simultaneously. Agents could scan for vulnerabilities, spray passwords, and abuse OAuth tokens around the clock, including weekends and holidays. This automation significantly reduced the window for defenders to detect and respond to intrusions. By modifying application credentials after gaining access, the attackers created backdoors that remained active even if the original compromised application was remediated, ensuring long-term persistence in the victim's cloud infrastructure.

Key details

• Storm-0940 used ARTEX to attempt sign-ins to over 2,250 tenants at a rate of 2,900 attempts per minute.
• The attack leveraged compromised ConnectWise Cloud Backup identities to authenticate to customer Microsoft 365 environments.
• ARTEX configurations included DeepSeek, GLM, and Grok models, with agents tasked to review each other’s work.
• In some cases, the timeframe from initial targeting to privileged access was less than three hours.
• The threat actor has been active since at least 2021 and previously used the Quad7 botnet for password spraying.
• ConnectWise temporarily shut down services and is restoring them in phases, a process expected to take several days.

Why it matters

This incident underscores the evolving threat landscape where agentic AI transforms supply chain attacks from slow, manual intrusions into rapid, automated campaigns. For software developers and security engineers, the traditional reliance on monitoring for anomalous human behavior is no longer sufficient. AI-driven attackers can adapt their tactics in real-time, exploiting trusted relationships between vendors and clients at a pace that overwhelms standard incident response teams. The ability of ARTEX to modify credentials and establish persistence means that simply revoking access to a compromised application may not fully remove the threat.

Furthermore, the use of closed-source AI tools like ARTEX, which was restricted after previous abuses in South Korea, demonstrates how quickly offensive AI capabilities can proliferate among state-aligned actors. The financial motivation observed in parallel campaigns by related groups, such as TAG-217, suggests that these tools are being refined for both espionage and profit. Organizations must now assume that any trusted third-party connection could be weaponized by AI agents capable of executing complex multi-step attacks without human intervention.

What you can do

• Audit all OAuth applications and third-party integrations for excessive privileges, ensuring they follow the principle of least privilege.
• Implement strict conditional access policies that require multi-factor authentication for service principals and high-risk sign-ins.
• Monitor for unusual spikes in failed logon attempts and cross-tenant authentication requests, especially from known vendor IP ranges.
• Review application credential logs regularly to detect unauthorized modifications or additions that could indicate persistence mechanisms.
• Enforce just-in-time access for administrative roles to limit the window of opportunity for privilege escalation.
• Verify the integrity of supply chain vendors by requesting details on their security practices and AI usage policies.