On 21 October 2026, Microsoft Threat Intelligence attributed the ConnectWise Cloud Backup compromise to Storm-0940, a China-state aligned actor, and named the tool: ARTEX, an open-source agentic AI penetration testing framework.
Microsoft dates the group's use of ARTEX to as early as September 2026, in a campaign automating attacks against hundreds of organisations globally across a wide range of industries.
The headline numbers are genuinely striking. In the ConnectWise campaign, Microsoft observed Storm-0940 reaching "more than 2,250 tenants at 2,900 sign-in attempts per minute". In several attacks, the time from initial targeting to privileged cloud access was under three hours.
One correction to how this is being framed. ARTEX is not a Chinese state cyberweapon. It is an open-source tool written by an individual security researcher to help defenders, published on GitHub, which several unrelated threat actors have since picked up. Microsoft itself says it has observed attackers from several geographic regions using it. Treating it as "their AI tool" misses what makes this case important.
What happened
The attribution
This closes a loop on a story that broke a week earlier. ConnectWise suspended its Cloud Backup service on 17 October after attackers used stolen application identities to sign into customer Microsoft 365 tenants. Microsoft has now named who did it and how they moved so fast.
Key dates from Microsoft's account:
When | What |
|---|---|
As early as September 2026 | Storm-0940 begins using ARTEX to automate attacks against hundreds of organisations |
14 October | Password spraying against 327 organisations, with Microsoft telemetry flagging 151,000 failed login attempts |
15 October | ARTEX used to compromise Microsoft 365 environments belonging to ConnectWise Cloud Backup customers |
21 October | Microsoft publishes the attribution |
Who was targeted
Microsoft lists an unusually broad industry spread: aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, the military, technology, and think tanks and non-profits.
That breadth is itself a signal. Targeting this wide is normally a resourcing problem. Automation removes the constraint.
What ARTEX is
ARTEX is a multi-agent system driven by large language models, written in Go with a Next.js front end. It coordinates AI agents across the stages of an intrusion: reconnaissance, vulnerability discovery, exploitation, credential attacks and data exfiltration, with little human input.
It is model-agnostic. It works with whichever AI model the operator supplies, and reporting has named commercial models including Claude and GPT alongside open models such as DeepSeek. No single AI provider controls access to it.
Where it came from
This is the part worth sitting with.
ARTEX was written by Li Puhua, a Chinese security engineer known online as Autumn, GitHub handle Autumn-27, who previously worked as a threat detection engineer at the Chinese security firm ThreatBook. It was published on GitHub in July 2026 and won a Chinese AI attack-and-defence competition in September 2026.
ThreatBook stated on 16 October that ARTEX originated as a personal project of its RedAgents product lead. The creator publicly condemned the tool's misuse in an October statement.
So the sequence is: a defensive security tool, built by a researcher, released openly, recognised in a competition, and within roughly three months in use by a state-aligned espionage group.
What the AI actually did
Microsoft is careful here, and so should we be. The underlying techniques are nothing new: stolen credentials, password spraying, and abuse of trusted cloud applications.
What AI changed was execution:
Speed. 2,900 sign-in attempts per minute. 151,000 failed logins in a single spraying campaign.
Parallelism. Agents pursuing multiple paths simultaneously rather than an operator working one at a time.
Persistence without interactive sign-in. The tooling allowed authentication to Microsoft 365 without an interactive user sign-in process.
Autonomous follow-through. Microsoft observed AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to modify privileges, which could let attackers remain even after the original credentials were revoked.
Microsoft's framing is that AI lets attackers "scale their operations exponentially". The compression from initial targeting to privileged access in under three hours is the measurable form of that.
Other campaigns, different actors
ARTEX has been linked to attacks beyond this one, and the attribution does not carry across:
South Korean financial institutions, from late September 2026. CrowdStrike and Recorded Future attribute this to a Chinese-speaking actor combining ARTEX with several different AI models. One assessment describes the operator as likely financially motivated rather than state-aligned.
Japanese companies, where investigators found ARTEX on six overseas servers targeting approximately 80 businesses.
Microsoft did not attribute those earlier attacks to Storm-0940. Different actors, same tool.
What Microsoft did not say
Worth noting for accuracy: Microsoft stated that successful access did not necessarily mean customer data had been stolen. Reaching a tenant and exfiltrating from it are different claims, and only the first is established.
Why it matters
Offensive tooling no longer needs to be developed by the attacker. Storm-0940 did not build ARTEX. They downloaded it. The research and engineering effort that once distinguished a capable state actor from an ordinary criminal has been externalised to an open-source project.
Defender response time is the thing under attack. A three-hour path from targeting to privileged access does not leave room for a human-paced detection and triage cycle. If your process involves an alert queue reviewed during business hours, the attack is finished before anyone opens the ticket.
Password spraying at 2,900 attempts per minute changes the maths. Detection thresholds tuned for human-speed credential attacks will either miss this or drown in it. The 151,000 failed logins in one campaign is the shape of the problem.
This is the dual-use dilemma in a concrete form. ARTEX was built to help defenders and won a competition for doing so. Its author condemned the misuse. None of that prevented it. Any tool that automates intrusion for testing automates intrusion.
The attribution does not fix the exposure. Knowing it was Storm-0940 does not change what ConnectWise customers need to do. The remediation for that incident, revoking application credentials and auditing tenant secrets, is unchanged.
Who is affected
ConnectWise Cloud Backup customers, whose Microsoft 365 tenants were the direct target on 15 October.
Organisations in the named sectors, particularly aerospace and defence, government, financial services and think tanks, which are classic espionage targets.
Any Microsoft 365 tenant with third-party applications holding broad permissions, which is the structural weakness ARTEX was pointed at.
Organisations relying on detection thresholds calibrated for human-speed attacks.
South Korean financial institutions and Japanese businesses, targeted by other actors using the same framework.
What organisations should do
Identity, because that is where this lands
Deploy phishing-resistant MFA, and verify it covers service accounts and application sign-in paths, not just interactive user logins.
Audit third-party application permissions in Entra ID. ARTEX was pointed at the permissions customers had already granted. Remove consent for applications you no longer use.
Restrict or block the device-code and other non-interactive authentication flows where you do not need them.
Review application credentials and certificates for unauthorised additions, which is how persistence survives a credential reset.
Detection at machine speed
Alert on authentication volume, not just failure patterns. 2,900 attempts per minute is not a subtle signal, but only if something is watching the rate.
Automate the first response. If an attacker can go from targeting to privileged access in under three hours, a manual triage queue is not a control. Automatic account lockout, session revocation and conditional access tightening need to fire without a human.
Monitor Microsoft Graph activity for reconnaissance patterns, credential changes and privilege modification attempts.
Reduce your mean time to revoke. The practical question is not whether you can detect this, but how long it takes you to kill a session once you do.
Supply chain
Inventory every application with access to your tenant, what permissions it holds and when it was last used.
Ask providers what happens to your tenant if their credentials are stolen, because that is precisely the scenario that played out here.
Expectations
Assume this tooling is now widely available. Microsoft has seen actors in several regions using ARTEX. This is not a single-actor problem and will not be solved by this attribution.
Final thoughts
Nothing in this campaign required a new technique. Password spraying is decades old. Abusing an over-permissioned cloud application is a well-documented pattern. The ConnectWise intrusion itself depended on credentials stolen from somewhere else entirely.
The lesson: AI did not give attackers new capabilities here, it removed the labour cost of old ones. That sounds like a smaller claim than "AI-powered cyberattack" and it is considerably more consequential. Techniques that were previously limited by how many hours an operator could spend are now limited by API rate limits. The constraint that kept broad, simultaneous, multi-target campaigns rare has been lifted.
The second lesson is about where the tool came from. ARTEX was built by a security researcher to help defenders, released openly, and celebrated in a competition. Its author condemned the misuse, which is both sincere and irrelevant to the outcome. There is no version of a tool that automates reconnaissance, exploitation and exfiltration for defensive testing that does not also do it for an attacker. That tension will not be resolved by better intentions from tool authors, and defenders should plan on the assumption that whatever is published for testing will be used in anger within months.
Two questions worth answering this week: how long does it take your organisation to revoke a compromised session once detected, and which third-party applications currently hold standing permissions in your tenant?
