Microsoft ties the ConnectWise compromise to Storm-0940, which automates attacks with ARTEX agentic AI

October 21, 2026. Microsoft attributes the ConnectWise Cloud Backup compromise to Storm-0940, a China-state aligned actor active since 2021. As early as September 2026. The same actor was using ARTEX, an agentic AI penetration-testing framework, to automate attacks against hundreds of organizations. Between October 10 and 14, 2026. A password-spray campaign generates 151,000 failed logons, at a pace of 2,900 attempts per minute. Why it matters: offensive AI has left the lab — in several cases the time from initial targeting to privileged access fell below three hours.

The attribution: what Microsoft asserts, and what it leaves open

The report leaves no room for doubt. Microsoft Threat Intelligence writes that Storm-0940 “used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally.” The list of targeted sectors is broad: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software and think tanks.

The actor has no known industry alias. It has operated since 2021, mostly for data theft. Its historical initial access runs through password spraying and the exploitation of internet-facing applications, then lateral movement via compromised accounts. In cloud environments it establishes persistence by adding credentials to existing OAuth applications — exactly the pattern seen here. What Microsoft does not specify is the exact number of organizations where privileged access was obtained: it only concedes that most targeting failed, but that the actor “achieved privileged cloud persistence at many organizations in a brief time.”

ARTEX, the framework that turns a pentest into an assembly line

ARTEX deserves attention because it is not just another tool. It is an open-source penetration-testing framework, a multi-agent system written in Go with a Next.js frontend, able to use any AI model to automate a full offensive workflow. Agents driven by LLMs chain reconnaissance, exploitation and exfiltration with little human interaction, accumulating discovered assets and vulnerabilities into a graph as the mission progresses. The interface defaults to English but switches to Korean, Mandarin, Spanish or Japanese.

The most worrying signal lies elsewhere. In October 2026, public reporting already linked ARTEX to personal-data breaches targeting Korean financial institutions. Microsoft says it has identified threat actors across multiple geographic regions using the same framework. An offensive tool that circulates between groups — and that a state actor industrializes — changes the nature of the problem: you are no longer defending against one attacker, but against a shared capability.

Speed as a weapon

The password-spray numbers are the most concrete part of the report. Between October 10 and 14, Storm-0940 infrastructure at 144.172.64[.]99 targeted 327 accounts across eight organizations to reach Microsoft 365 and Exchange Online. Microsoft telemetry captured 151,000 failed logon events, peaking at 2,900 failures per minute on October 11 and concentrating more than 111,000 failures into a single day. 48 accounts received more than 1,000 failures each, and lockout responses made up nearly 98% of the activity. No successful authentication was observed at that stage.

The next stage was more effective. After taking control of several ConnectWise cloud application identities, the ARTEX agents attempted to sign in to more than 2,250 tenants at 2,900 sign-ins per minute, including over 200 sign-ins in under four minutes using four application credentials. In several environments the activity went beyond authentication: reconnaissance through Microsoft Graph, application credential modifications to establish persistence, and changes to identities, groups and privileged roles. That is the decisive point — the attacker needs no vulnerability: they abuse permissions a legitimate application had already been granted.

What this changes for defenders

The strategic lesson is that AI speed compresses the response window. Microsoft says it directly: automation generates traffic that triggers alerts, but “the speed of the activity allows very little time for defenders to respond to those alerts and remediate the actor’s access in a coordinated fashion.” An agent does not stop for weekends, does not sleep, and pursues multiple attack paths in parallel. The result is measured in hours, not days.

The fix is not a patch — Microsoft stresses that the activity “did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.” It is a permission-governance problem: a high-privilege multi-tenant application became the pivot of the attack. The recommended defenses follow logically: apply least privilege to multi-tenant application permissions, monitor credential additions and role changes, and review successful and failed service-principal sign-ins separately.

What to look for in your logs

The Microsoft report also provides concrete indicators, which is what makes the episode actionable. The addresses 144.172.64[.]99, 144.172.64[.]128 and 144.172.64[.]60 were observed performing sign-ins and Graph API activity in customer environments of the ConnectWise applications. The associated user agents — Python-urllib/3.12, python-requests and curl/7.88.1 — are signatures to hunt for in your authentication logs.

Good practice is to review successful and failed service-principal sign-ins separately, then correlate the Graph activity that follows with your known administrative operations. In Sentinel, a simple hunt over the service-principal sign-in table is enough to rule out the worst:

// Service principal sign-ins from the Storm-0940 infrastructure
AADServicePrincipalSignInLogs
| where TimeGenerated between (datetime(2026-10-10) .. datetime(2026-10-16))
| where IPAddress in ("144.172.64.99", "144.172.64.128", "144.172.64.60")
| project TimeGenerated, ServicePrincipalName, AppId, IPAddress, ResultType

Beyond the IPs, the most reliable signal is still behavior: a service principal that assigns itself the Global Administrator role when it never had it in the previous seven days is an alert to treat as a priority, whichever vendor was compromised. That is exactly the detection Microsoft Defender XDR enabled under the name “Application self-assigned Global Administrator role.”

An open framework is a shared capability

The uncomfortable detail is that ARTEX is open source. Microsoft notes the framework was already linked to personal-data breaches at Korean financial institutions in October, and that actors across multiple regions are using it. An offensive tool shipped as public code does not stay in one actor’s hands: the moment a state operator proves it works at scale, smaller groups inherit the same capability at zero development cost. That changes the math for defenders, because the barrier to entry for agentic attacks just fell to a git clone. Detection and response tooling that assumes a human-paced adversary — and budgets sized for it — now face an adversary that retries in parallel and never sleeps. The answer is not panic but parity: baseline your service-principal and Graph activity now, so that machine-speed anomalies stand out from your legitimate automation. Meeting a machine-speed adversary on equal footing is the only sustainable posture.

Verdict

If you have granted broad permissions to a third-party application, treat every service-principal sign-in as a first-class alert signal: it is now the preferred entry path of an actor that automates at machine speed. Cut consent grants to the strict minimum, revoke unused permissions, and correlate Microsoft Graph logs with your administrative operations. If you are not affected by ConnectWise, use this episode as a test of your own application-identity surface — a compromised vendor should never be able to offer an attacker more than you explicitly granted it.

References

• Microsoft Threat Intelligence — Storm-0940 uses ARTEX agentic AI to enable supply chain compromise
• The Hacker News — China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
• CyberScoop — Microsoft pins ConnectWise supply-chain attack to China-state aligned Storm-0940
• ETTAYEB — A ConnectWise Cloud Backup service-principal compromise opens 173 Microsoft 365 tenants