China-linked hackers used an AI pen-testing tool to hit 2,250 cloud tenants in minutes
Microsoft says Storm-0940 wired the open-source ARTEX framework into the ConnectWise supply chain attack, going from first contact to privileged cloud access in under three hours.
Key points
- Microsoft says a China-aligned group it tracks as Storm-0940 used an open-source AI hacking tool called ARTEX to reach more than 2,250 customer tenants during the October 2026 ConnectWise supply chain breach, hitting 2,900 sign-in attempts per minute.
- In several cases the hackers went from first touching a target to holding privileged access to its cloud in under three hours.
- A password-spraying run from the same server, at 144.172.64.99, between October 10 and 14 produced over 151,000 failed logins against 327 accounts at eight organisations before the ConnectWise activity surfaced.
- Microsoft stresses the attacks did not stem from any flaw in its own products, and that a successful sign-in does not by itself mean data was stolen.
- Industries named as targets include aerospace, defence, government, financial services, legal, semiconductors and think tanks.
Microsoft has published one of the clearest accounts yet of what happens when a nation-state crew plugs a generative AI agent into its day job. The write-up, from the Microsoft Security Response Center, pins the recent ConnectWise supply chain breach on Storm-0940, a China-aligned group active since 2021, and says the group drove the campaign with an open-source framework called ARTEX.
ARTEX is a penetration-testing kit, meaning software built to simulate hacking, that chains together multiple AI agents to run an intrusion from start to finish with little human input. It's written in Go with a Next.js web interface and can swap in different large language models. Public reporting in October tied the same tool to data breaches at Korean financial institutions.
The mechanics matter here. Storm-0940 didn't find a new flaw in Microsoft 365. It abused OAuth applications, the trusted connectors that let third-party software sign in to a tenant on a user's behalf, and it did so at machine speed. Once the agents controlled the identities of several ConnectWise cloud apps, they authenticated into downstream customer environments without any user ever clicking a prompt. We've tracked OAuth abuse across 37 stories since May 2026, and this campaign is the most operationally automated instance we've reported.
How fast did this actually move?
Fast enough that alerts fired without defenders having time to act. Microsoft recorded 2,900 sign-in attempts per minute against ConnectWise downstream tenants, and in multiple cases the gap between first targeting an organisation and gaining privileged cloud access was under three hours.
The preceding password-spray run from 144.172.64.99, where attackers try common passwords across many accounts, concentrated more than 111,000 failures into October 11 alone. Lockouts accounted for roughly 98% of the traffic. No account fell during that phase, but the same IP address resurfaced four days later inside the ConnectWise incident.
| Date (2026) | Event | Scale |
|---|---|---|
| Oct 10 to 14 | Cross-tenant password spray from 144.172.64.99 | 151,000+ failed logins, 327 accounts, 8 orgs |
| Oct 11 | Peak spray day | 111,000+ failures |
| Oct 15 | ConnectWise compromise reports surface | Same IP range |
| Oct 16 | ConnectWise advisory published | 144.172.64.99 confirmed |
| Oct (ongoing) | ARTEX-driven downstream access | 2,250+ tenants reached |
What should affected organisations do?
Treat any OAuth application that touched a ConnectWise-linked identity as suspect, and work through ConnectWise's containment steps while keeping logs intact for investigators. Microsoft's own guidance on monitoring application activity in Entra ID tells administrators to watch for credential changes on service principals, unexpected permission additions and sign-ins at odd hours, which is exactly the pattern the agents produced through Microsoft Graph.
Review service principal sign-in logs for the 144.172.64.99 address. Look for application credential additions you didn't authorise. If a connector app suddenly granted itself broader directory rights or new persistence mechanisms, rotate credentials immediately.
What this means for everyone else
Having watched this beat for a while, I'd say the ARTEX disclosure is the moment the industry has been bracing for: a known adversary group stops bolting AI onto one step of an attack and lets agents run the whole chain. The scale isn't the shocking part. Password sprays have hit those volumes before. The compression of the timeline is. Three hours from target selection to privileged persistence doesn't leave room for a Tuesday morning stand-up, let alone a coordinated response.
For ordinary customers of a breached software vendor, the practical lesson is older than AI. If a product you rely on connects into your email or files through an OAuth app, that connector's a key to your house. Audit the keys you've handed out, and revoke the ones you can't explain.
