Microsoft Says China-Aligned Storm-0940 Used ARTEX AI Agents to Breach ConnectWise and Target Hundreds of Organisations

Microsoft said on 21 October 2026 that Storm-0940, a hacking group it describes as aligned with the Chinese state, used an open-source AI penetration-testing framework called ARTEX to compromise IT services vendor ConnectWise and go after hundreds of organisations, according to Microsoft's threat-intelligence write-up. Microsoft says several intrusions delivered privileged cloud access in under three hours after initial targeting. If the attribution holds, it is among the clearest public cases of autonomous AI agents driving a real supply-chain attack rather than assisting a human operator.

What happened at ConnectWise?

The incident first surfaced as a vendor outage. BleepingComputer reported on 17 October that ConnectWise had cut customer access to its Cloud Backup service, formerly SkyKick Cloud Backup, after attackers gained access to application identities and entered customers' Microsoft 365 tenants. Security firm Huntress confirmed unauthorised sign-ins in at least 162 tenants. Microsoft recorded unauthorised authentication attempts from the IP address 144.172.64.128 on 15 October and called the incident an active supply-chain attack.

The mechanism matters. Security firm Todyl found that the attacker authenticated directly as the backup application using its secret, through automated scripts. Because no human user signed in, multi-factor authentication offered no protection. Microsoft said the actors likely abused permissions that customers had previously granted to the application, including highly elevated ones such as Directory.ReadWrite.All.

In some tenants the damage went further. Huntress saw service principals for ConnectWise Cloud Management apps assign themselves directory roles, mostly Exchange Administrator, in nearly 50 tenants. In one tenant, an app granted itself Global Administrator and added credentials to other tools in roughly five minutes, BleepingComputer reported.

ConnectWise's response widened over a weekend. The Record reported that the company also suspended its SaaS Security and Cloud Management platforms, with no restoration timeline, and revoked certificates for affected application connections. ConnectWise says there is "no indication" that backup data was compromised, but it cannot see inside partner and customer environments and so cannot confirm which customers were breached.

What did Microsoft add on 21 October?

Microsoft's report ties the compromise to a specific actor and tool. It says Storm-0940 has been active since 2021, targets organisations for data theft and has no known industry aliases. Microsoft assesses that the group was responsible for the ConnectWise compromise of a multi-tenant application.

ARTEX, according to Microsoft, is an open-source penetration-testing framework that can use any AI model. It is a multi-agent system written in Go with a Next.js front end, supports five languages including Korean and Mandarin, and runs autonomous tests from reconnaissance to data exfiltration, storing discovered assets and vulnerabilities in a graph. Microsoft says multiple threat actors in different regions use it, and notes public reporting in October 2026 of its use in breaches of Korean financial institutions.

The figures Microsoft gives describe machine-speed activity:

- Storm-0940 began using ARTEX against hundreds of organisations in September 2026, across defence, energy, financial services, government and semiconductors. - A password-spray campaign from 144.172.64.99 between 10 and 14 October targeted 327 accounts across eight organisations, with more than 151,000 failed logon events and a peak of 2,900 failures per minute on 11 October. - The actor attempted sign-ins to more than 2,250 tenants, including over 200 sign-ins in under four minutes using four application credentials. - In multiple environments, agents performed bulk reads of Azure Key Vault secrets across several vaults, and one ConnectWise application was used to assign itself the Global Administrator role.

A wire report carried by KFGO adds that most targeting failed, though the group quickly gained privileged cloud persistence at many organisations. Microsoft states the activity "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services."

How do the accounts differ?

The sources do not line up perfectly, which is normal for a fast-moving incident. Huntress counts 162 tenants with confirmed unauthorised sign-ins; Microsoft counts attempted sign-ins to more than 2,250 tenants. Those are different measures, attempts versus confirmed access, and should not be added together or compared directly. Microsoft's password-spray window runs from 10 to 14 October, while The Record, citing Huntress, describes password spraying against four law firms on 13 and 14 October. Microsoft also cautions that an affected application or a successful authentication does not necessarily mean customer data was accessed or stolen.

Attribution is contested. According to the wire report, the Chinese Embassy in Washington rejected the accusations and said China opposes hacking. ConnectWise chief executive Manny Rivelo said the company has contained the affected application connections and is restoring services, and that unauthorised access inside individual customer tenants still needs separate review.

Why does it matter for AI security?

The case reframes a familiar warning. Security researchers have long said AI would lower the cost of scaling attacks. Microsoft's account describes a framework that any actor can download, point at any model and run against hundreds of targets, with lockouts accounting for nearly 98% of the activity it observed in the password spray. The defence implications are practical rather than novel: the stolen asset was a shared application credential with broad, long-lived permissions, and no AI was needed to make that dangerous. What the agents appear to have added, on Microsoft's telling, is volume and speed, including privileged access in under three hours.

Managed service providers sit at the centre of the risk. The Record quotes Huntress warning that an application with directory-role access could make itself a Global Administrator and give attackers persistent access beyond the original credential, and that providers could spread an intrusion to their other customers. Microsoft's recommendations are accordingly operational: keep affected ConnectWise connections disabled until the vendor issues restoration instructions, preserve evidence before deleting enterprise applications, search by application ID rather than display name, review activity from at least 15 October, revoke unnecessary permissions and rotate credentials where activity is suspicious. Todyl adds that disabling an app stops new tokens, but tokens already issued stay valid until they expire.

What we don't know yet

Three questions remain open. The overall number of victims and the extent of any data theft have not been established. How the attacker obtained ConnectWise's credentials in the first place has not been explained in the reporting reviewed here. And Microsoft's attribution to a Chinese-aligned actor rests on Microsoft's own assessment, which the Chinese government disputes and which this article has not been able to verify independently. Until ConnectWise and the affected customers finish their reviews, the confirmed picture is of a serious vendor-credential compromise with AI-driven tooling in the attack chain, not yet a full accounting of harm.