Microsoft says Storm-0940 used the ARTEX agent framework in the ConnectWise compromise; it names no AI model

Microsoft Security published 'AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise' on 21 October.

AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise ... October 21 (datePublished 2026-10-21T18:23:55+00:00)

Microsoft says Storm-0940 is a China-state aligned actor, active since 2021, that targets organizations across multiple industries for data theft.

Storm-0940 is a China-state aligned actor (with no known industry aliases) that has been active since 2021 and targets organizations across multiple industries for data theft.

Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.

Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.

Microsoft says ARTEX is an open-source penetration testing framework that can use any AI model to automate offensive security workflows, and is a multi-agent LLM system written in Go with a Next.js frontend.

ARTEX is an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows. The ARTEX framework is a multi-agent LLM system written in GO with a Next.js frontend.

Microsoft says ARTEX's agents run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.

ARTEX is a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.

Microsoft says that as early as September 2026 Storm-0940 used ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries.

As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries.

Microsoft says several Storm-0940 ARTEX-driven attacks resulted in the actor obtaining privileged access to an organization's cloud infrastructure, including multiple instances where the time from initial targeting to privileged access was less than 3 hours.

Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours.

Microsoft says that following the unauthorized access, Storm-0940 used ARTEX to attempt to sign in to more than 2,250 tenants.

Following the unauthorized access, Storm-0940 used ARTEX to attempt to sign-in to more than 2,250 tenants.

Microsoft says it identified multiple customer environments with follow-on activity through Microsoft Graph, including reconnaissance and application credential modifications.

In multiple affected environments, Microsoft observed AI-accelerated follow-on activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges

Microsoft says the majority of the targeting wasn't successful, and that the presence of an affected application or successful authentication does not necessarily indicate that customer data was accessed or exfiltrated.

While the majority of the targeting wasn’t successful ... the presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated.

Microsoft says the ARTEX activity did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.

The activity conducted by the threat actor through the usage of ARTEX framework did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.

Microsoft says that between October 10 and 14, 2026, Storm-0940 infrastructure ran a password-spray campaign against 327 accounts across eight organizations, with 151,000+ failed logon events, and no successful authentication was observed.

Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations ... Microsoft telemetry captured 151,000+ failed logon events ... Despite the scale, no successful authentication, token issuance, Graph call, or directory change was observed.

Microsoft says ConnectWise published an initial advisory on October 16, 2026, about attempted unauthorized access associated with Cloud Backup.

ConnectWise published an initial advisory on October 16, 2026, and subsequently expanded its disclosures and containment guidance. The advisory details ConnectWise’s investigation of attempted unauthorized access associated with Cloud Backup.

Microsoft does not say which AI model Storm-0940 used with ARTEX; its post describes ARTEX as able to use any AI model.

ARTEX is an open-source penetration testing framework that can use any AI model

ConnectWise's status page says that on Oct 16, 2026 it was investigating attempts of unauthorized access associated with its Cloud Backup environment (formerly SkyKick), and on Oct 17 that it had identified unauthorized access to application identities.

October 16, 2026 5:48PM UTC INVESTIGATING ConnectWise is investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment. ... October 17, 2026 5:11AM UTC IDENTIFIED We recently identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.

ConnectWise's status page says seven application identities were disabled on Oct 17, 2026, and a full reset of all accounts and credentials in the affected Cloud Backup environment was completed on Oct 19, 2026.

At 07:00 UTC on October 17, 2026, we disabled the seven ConnectWise application identities posted on our Trust Center page. ... On October 19, we completed a full reset of all accounts and credentials in the affected Cloud Backup environment.

ConnectWise's status page says it has no evidence the encrypted backup archives were accessed, and that it cannot determine from its own investigation whether individual partners' or customers' Microsoft 365 environments were affected, so partners are advised to review their tenants.

We have no evidence that these encrypted backup archives have been accessed. ... we cannot determine through our investigation alone whether a particular customer’s Microsoft 365 environment experienced unauthorized activity. Partners should continue reviewing their environments with their security teams or managed security providers.

ConnectWise's status page says phased restoration began on Oct 21, 2026.

October 21, 2026 2:35PM UTC IDENTIFIED ... We have begun restoring services in controlled phases, following remediation and security validation. ... We expect restoration to take several days.