A sophisticated China-linked threat actor has been heavily leveraging an open-source artificial intelligence penetration testing framework known as Artex to automate a sweeping cyberattack campaign targeting ConnectWise environments and hundreds of organizations worldwide, according to new intelligence reports published by Microsoft and other major cybersecurity firms.
The threat group, tracked by Microsoft under the designation Storm-0940, has maintained an active presence in the cyber threat landscape since at least 2021. Historically, this advanced persistent threat (APT) has built its operations around traditional intrusion techniques, relying heavily on credential harvesting methods like password spraying and exploiting vulnerable, internet-facing applications to breach high-profile organizations across a diverse array of global industry sectors.
However, recent campaign activities indicate a significant evolution in the group’s operational capabilities. Beginning in early September 2026, threat intelligence observers—including CrowdStrike, Zscaler, and Recorded Future—detected Storm-0940 abusing the Artex framework to execute and automate its attacks at unprecedented speeds. Initial reporting linked this surge in AI-powered malicious activity to targeted campaigns directed at South Korean financial institutions, signaling that the threat actor was testing and refining its automated methodologies in specific regional theatres before expanding its scope.
The operational escalation culminated in mid-October 2026, when Microsoft confirmed that Storm-0940 utilized the Artex framework to orchestrate automated intrusions directly into the environments of ConnectWise customers. The scale and speed of the breach prompted swift defensive action from ConnectWise, which took the precautionary step of suspending several core cloud services, including Cloud Backup, SaaS Security, and Cloud Management, to stem the flow of unauthorized access.
During this critical window, cybersecurity response firm Huntress observed threat actors successfully leveraging compromised ConnectWise application credentials to pierce the perimeter of hundreds of Microsoft 365 tenants. The intrusion footprint extended to more than 300 individual Entra tenants, showcasing the wide-reaching supply chain implications of the compromise.
According to Microsoft’s detailed technical breakdown, the threat actor relied on the Artex framework to drastically accelerate reconnaissance operations, execute large-scale password spraying attacks, and systematically abuse OAuth applications. In a matter of days, the automated tooling enabled the group to strike over 300 accounts spread across eight distinct organizations at a staggering pace, generating more than 2,900 access attempts per minute.
Following the initial unauthorized access phases, Microsoft observed Storm-0940 utilizing Artex to attempt sign-ins targeting more than 2,250 separate corporate tenants. While OAuth application abuse has long been a staple technique within Storm-0940’s standard operational toolset, the integration of the Artex framework allowed the adversary to transition these traditional tactics into machine-speed execution. Telemetry gathered by Microsoft captured upwards of 151,000 failed logon events directly associated with the campaign, interspersed alongside successful authentications into customer environments using the compromised identities of multiple trusted ConnectWise cloud applications.
Once inside these vulnerable environments, the automated AI agents operating on behalf of the threat actor progressed far beyond simple authentication. Microsoft’s analysis revealed that the agents executed complex post-exploitation procedures involving Microsoft Graph and directory operations. These activities encompassed comprehensive internal reconnaissance, the modification of application credentials to establish robust persistence mechanisms, and unauthorized alterations to identities, security groups, and highly privileged administrative roles.
By systematically changing application credentials, the attackers ensured sustained, persistent access to the victims’ corporate environments even after the affected ConnectWise applications underwent standard security remediation and patching. This resilience highlights the elevated risk introduced by autonomous threat agents capable of modifying cloud infrastructure configurations faster than traditional manual incident response teams can isolate them.
In light of these findings, Microsoft has issued urgent guidance to enterprise defenders, advising organizations to rigorously examine service principal sign-in logs alongside subsequent Microsoft Graph activity, directory alterations, and internal resource access patterns. Security teams are urged to meticulously correlate these suspicious events against authorized administrative actions to identify hidden footholds.
The geographic and sectoral breadth of the Storm-0940 campaign underscores the indiscriminate nature of the threat. Since early September, the APT has deployed Artex in automated onslaughts against hundreds of organizations spanning aerospace, automotive, chemicals, defense, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, and technology sectors, in addition to non-profit entities and prominent policy think tanks.
Further illuminating the technical mechanics of the threat group’s operations, Zscaler published an in-depth technical analysis examining Storm-0940’s AI-assisted hacking operations. The research report provided granular insights into how the threat actor configures Artex, detailing synchronization scripts, Claude Code prompt histories, and advanced network routing tools used to mask the origin of the automated intrusions.
