Microsoft Ties Storm-0940 to ARTEX-Driven ConnectWise Hack

In some cases, Microsoft says, attackers achieved "privileged access to an organization's cloud infrastructure" in "less than 3 hours" from initial targeting.

The disclosure came Wednesday from Microsoft, which tied the recent ConnectWise Cloud Backup supply chain compromise to a China state-aligned actor it tracks as Storm-0940. The group ran the operation through ARTEX, a Go-based agentic AI penetration testing framework that was pushed closed-source after being abused in attacks on South Korean financial institutions.

Between October 10 and 14, 2026, Microsoft says infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations, generating more than 151,000 failed logon events. Activity peaked October 11 at 2,900 failures per minute, with 111,000 failures in that single day across more than 2,250 tenants. On October 15 the agents obtained identities of multiple ConnectWise cloud applications and used them to authenticate into customer environments.

"Agents are not constrained by factors affecting humans," Microsoft wrote; they can "work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously." The company said the ARTEX activity let Storm-0940 "authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in."

Zscaler ThreatLabz researcher Seongsu Park reported ARTEX configurations pointing at DeepSeek, GLM, and Grok through OpenAI-compatible gateways, with prompts that "directed AI models to divide investigation tasks and review one another's findings." Recorded Future's Insikt Group is tracking a related Chinese-speaking cluster that has gone after South Korean banks as TAG-217. The campaign has run since September 2026 against tenants in aerospace, defense, energy, government, semiconductor, software, and think tanks. It lands on a busy day for our cybersecurity tracker.