Summary
Microsoft says the China-state-aligned group Storm-0940 used the ARTEX AI penetration-testing framework to automate attacks, including activity following a ConnectWise cloud application compromise. It observed privileged access in multiple customer environments, while noting that an affected application or successful sign-in alone does not establish that customer data was accessed.
Microsoft says the China-state-aligned group Storm-0940 used ARTEX, an AI-enabled penetration-testing framework, to automate attacks against organizations worldwide and exploit a compromised ConnectWise cloud application. In a report published on October 21, 2026, Microsoft said it observed privileged access to cloud infrastructure in multiple customer environments, with several cases reaching that access in under three hours from initial targeting.
The campaign involved attempts across a broad set of organizations, but Microsoft says most targeting was unsuccessful. It also cautions that an affected application or a successful authentication does not by itself mean customer data was accessed or taken.
How ARTEX was used
ARTEX is an open-source framework built around multiple AI agents and large language models. Microsoft describes it as capable of automating penetration-testing workflows, from reconnaissance through data exfiltration, with little human interaction. It can use different AI models and accumulates discovered assets and vulnerabilities during a test.
Microsoft says Storm-0940 used ARTEX to accelerate scanning and reconnaissance, password spraying and abuse of OAuth applications. In this case, the group used credentials from compromised ConnectWise cloud applications to attempt sign-ins to customer Microsoft 365 environments. Because those applications had already been granted access, the activity could use application authentication rather than require an interactive sign-in by a user.
Microsoft observed follow-on activity through Microsoft Graph, the interface applications use to interact with Microsoft cloud services. This included reconnaissance, application credential changes and attempts to alter privileges. Such changes can help an attacker maintain or expand access. Microsoft reports that some activity progressed to directory operations involving identities, groups and privileged roles.
The ConnectWise-related activity followed a separate password-spraying campaign Microsoft observed from October 10 to 14, 2026. That campaign targeted 327 accounts across eight organizations and generated more than 151,000 failed logon events. Microsoft observed no successful authentication, token issuance, Graph call or directory change in that campaign. Microsoft later noted that an IP address associated with the earlier activity also appeared among indicators connected to the ConnectWise incident.
Scale, speed and customer response
Microsoft says ARTEX was used to attempt sign-ins to more than 2,250 tenants, at a rate of 2,900 attempts per minute. The company reports that the threat actor obtained privileged cloud access in multiple environments, including several where the time from initial targeting to privileged access was less than three hours. The speed and volume of automated activity can leave defenders little time to investigate alerts and remove access.
Microsoft recommends that organizations review service-principal sign-ins—the records of applications authenticating to a service—alongside subsequent Microsoft Graph activity and directory audit records. It advises preserving investigation evidence, checking for unexpected application credential additions and privilege changes, and keeping affected ConnectWise application connections disabled until ConnectWise provides restoration instructions. A compromised multi-tenant application can put customer environments at risk because its existing permissions may allow it to act across organizations that authorized it.