Microsoft says China-linked hackers used AI penetration testing tool ARTEX to compromise ConnectWise and target hundreds of organizations

In a research report published on October 21, 2026, Microsoft Security Blog attributed a supply chain attack against IT services firm ConnectWise and a subsequent campaign targeting hundreds of global organizations to Storm-0940, a China-state aligned threat actor. The report states that since September 2026, the group has been using ARTEX, an open-source agentic AI penetration testing framework, to automate its offensive workflows.

ARTEX is a multi-agent LLM system capable of autonomously executing penetration tests from reconnaissance through data exfiltration with minimal human interaction. Microsoft observed that Storm-0940 leveraged ARTEX to accelerate scanning, password spraying, and OAuth application abuse. In multiple instances, the time from initial targeting to obtaining privileged access to an organization’s cloud infrastructure was less than three hours. This machine-speed activity generated significant log volume but left defenders with very little time to coordinate a response.

The campaign targeted sectors including aerospace, defense, automotive, energy, financial services, government, legal, manufacturing, media, semiconductor, and software. While most attempts were unsuccessful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief period. Microsoft emphasized that these activities did not result from vulnerabilities in Microsoft’s own products or services, but rather from the abuse of previously granted third-party application access.

ConnectWise had previously issued an advisory on October 16 regarding unauthorized access attempts associated with its Cloud Backup environment. Microsoft advised customers to review service principal sign-ins, investigate unexpected application credential or privilege changes, and follow ConnectWise’s containment guidance.