Microsoft said on Wednesday that Storm-0940, a China state-aligned hacking group it has tracked since 2021, used the agentic AI penetration-testing framework ARTEX to automate attacks against hundreds of organisations worldwide, and that the same group was responsible for the recently disclosed supply-chain compromise of ConnectWise Cloud Backup. In several cases, Microsoft said, the time from first targeting to privileged access to a victim’s cloud infrastructure was less than three hours.
The disclosure, published by Microsoft Threat Intelligence on October 21, is the broadest attribution yet for ARTEX, the open-source framework that runs a penetration test from reconnaissance through data exfiltration with little human interaction. It follows earlier reporting that the same framework was used against Japanese companies, covered in the GMO investigation into ARTEX attacks in Japan.
Storm-0940 And ARTEX: How The Campaign Ran
Microsoft said Storm-0940 began using ARTEX as early as September 2026 across aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software and technology organisations, plus think tanks and non-profits. ARTEX is a multi-agent system written in Go with a Next.js front end; it can plug in any AI model and accumulates the assets and vulnerabilities its agents discover into a graph as a test proceeds.
The speed is the point. Agents are not constrained by working hours, Microsoft noted, and can attempt multiple breach paths at the same time. During the ConnectWise compromise, the group used ARTEX to accelerate scanning and reconnaissance, password spraying and OAuth application abuse against downstream victims, authenticating to Microsoft 365 environments through applications that had already been granted access — so no interactive user sign-in was needed.
The ConnectWise Numbers: 2,250 Tenants At 2,900 Attempts A Minute
ConnectWise published an initial advisory on October 16 about attempted unauthorised access linked to its Cloud Backup product, formerly SkyKick. After gaining control of the identities of several ConnectWise cloud applications, Microsoft said, the attackers used ARTEX to attempt sign-ins to more than 2,250 tenants at up to 2,900 sign-in attempts per minute. In some environments the activity moved past authentication into Microsoft Graph and directory operations, including reconnaissance, application credential changes and attempts to modify privileges.
The password-spraying phase that preceded it was also run at machine pace. Between October 10 and 14, Microsoft telemetry captured more than 151,000 failed logon events against 327 accounts across eight organisations from a single IP address, peaking at 2,900 failures per minute on October 11, with more than 111,000 failures in one day. Microsoft said no successful authentication was observed in that particular spray. ConnectWise chief executive Manny Rivelo said in a separate statement, reported by Reuters, that based on Microsoft’s analysis and the evidence available to ConnectWise, a China state-aligned group appeared responsible, and that the company had contained the affected application connections and was restoring services in controlled phases. A spokesperson for the Chinese Embassy in Washington told Reuters that China opposes and fights hacking in accordance with the law and opposes smears under the excuse of cybersecurity issues.
What Defenders Are Told To Do Now
Microsoft stressed that an affected application, or even a successful attacker authentication, does not by itself mean customer data was accessed or taken, and that the activity did not result from a compromise of Microsoft’s own systems, products or services. Its guidance is specific: keep affected ConnectWise application connections disabled until ConnectWise issues formal restoration instructions, preserve evidence rather than deleting enterprise applications as a first response, and inventory the four application IDs listed in its report in every tenant where the applications are or were installed.
Defenders are also told to review activity from at least October 15 — and service-principal sign-ins back to October 1 where records allow — for credential additions, new owners, consent grants and privileged role changes, because a credential change made by the attackers can survive as a backdoor after the original compromised application is remediated. The pattern echoes other recent compromises in the AI tooling stack, such as the LiteLLM PyPI backdoor and the PHP2Shell flaws.
Why It Matters
ARTEX matters because it changes the economics of a supply-chain compromise. A framework built for legitimate penetration testing, driven by whatever model its operator chooses, let one group spray more than 151,000 logons, reach more than 2,250 tenants and, in some cases, go from selection to privileged cloud access in under three hours. For the thousands of organisations that grant third-party applications standing access to their Microsoft 365 tenants, the trust placed in those applications — and the credentials added to them afterwards — is now the perimeter that has to be audited. Microsoft’s attribution also widens the ARTEX story well beyond one region: the same tooling previously reported in Korea and Japan is now tied by Microsoft to victims across a dozen industries worldwide.
Background
Storm-0940 has been active since 2021, historically gaining access through password spraying and exploitation of internet-facing applications, then keeping access to Microsoft 365 by adding credentials to existing OAuth applications. ARTEX itself was released in July 2026 as an open-source penetration-testing framework and was reported in October to have been used in personal-data breaches at South Korean financial institutions; Microsoft said it has now identified actors in multiple regions using it. ConnectWise Cloud Backup, the product at the centre of this compromise, was formerly known as SkyKick.
Source: Microsoft Security Blog, Reuters
0 Comments