INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Storm-0940 uses ARTEX AI framework to breach ConnectWise Cloud

| 2026-10-22 20:42 MEDIUM HIGH AI-ENABLED ATTACK · AUTONOMOUS DATA BREACH SUPPLY CHAIN STATE-SPONSORED & ESPIONAGE
JSON
Executive Summary
AI-generated
China-state-aligned hackers used ARTEX, an AI-powered penetration-testing framework, to attempt access to more than 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach. Hackers used AI agents and stolen ConnectWise application credentials to attempt access to more than 2,250 Microsoft 365 tenants, according to Microsoft’s technical investigation report. A China-linked threat actor that Microsoft tracks as Storm-0940 used an agentic AI penetration-testing framework to accelerate a supply chain attack involving ConnectWise Cloud Backup.
Technical Mitigations AI-generated
• Keep affected ConnectWise application connections offline till further notice. • Review your individual Microsoft 365 environments using the company's technical investigation and remediation guide and related information. • Keep connections disabled.
Technical Observables 18 IoCs Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 18 IoCs Create Free Account
urls 1 domains 1 ips 16
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Storm-0940Storm-0940 ARTEXARTEX
Target & Sectors
CN
automotiveautomotive governmentgovernment technologytechnology aerospaceaerospace defensedefense financefinance manufacturingmanufacturing
Incident Timeline
‎September 2026
Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries starting as early as September 2026.
organisation ARTEX
“As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries,” Microsoft Security Research wrote in a blog post Wednesday.
organisation Microsoft Security Research
“As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries,” Microsoft Security Research wrote in a blog post Wednesday.
‎Oct. 14
14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.
infrastructure Microsoft 365
During a four-day stretch ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.
general_metric 327 accounts
During a four-day stretch ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.
organisation Microsoft 365 and Exchange Online
During a four-day stretch ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.
‎Oct. 16
ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup product on October 16.
‎2026/10/22
China-state-aligned hackers used AI-powered penetration-testing framework ARTEX to target over 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach.
organisation Microsoft 365
Related: State Bank of India Suffers a Customer PII Data Leak ConnectWise provides software and IT management technology that managed service providers use to deliver a broad range of services to their customers, including backup and recovery for Microsoft 365 data.
The attackers used compromised application credentials associated with the service to attempt to access the Microsoft 365 environments of more than 2,250 downstream customer tenants.
Delivering these services requires the company to have authorized application access to customer Microsoft 365 environments to back up and restore data.
organisation Microsoft
China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach.
Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise.
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants.
organisation ConnectWise
Related: State Bank of India Suffers a Customer PII Data Leak ConnectWise provides software and IT management technology that managed service providers use to deliver a broad range of services to their customers, including backup and recovery for Microsoft 365 data.
Hackers used AI agents and stolen ConnectWise application credentials to attempt access to more than 2,250 Microsoft 365 tenants, according to Microsoft’s technical investigation report.
Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants.
organisation ARTEX
The Windows giant  revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments.
China-state-aligned hackers used ARTEX, an AI-powered penetration-testing framework, to attempt access to more than 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach.
Microsoft attributed the campaign to Storm-0940, a China-state-aligned group, and said its ARTEX framework accelerated reconnaissance, authentication attempts, and cloud persistence.
organisation Microsoft Graph
"In multiple affected environments, Microsoft observed AI-accelerated follow-on activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access," Microsoft said.
Microsoft also observed AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes, and attempts to modify privileges, potentially allowing the attackers to stick around even after the original credentials were revoked.
“In some of these environments, the AI agents (on behalf of the threat actor) progressed beyond authentication to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles,” researchers wrote.
victims 2,250 downstream customer tenants
The attackers used compromised application credentials associated with the service to attempt to access the Microsoft 365 environments of more than 2,250 downstream customer tenants.
The attackers abused stolen application credentials and permissions […] The post China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach appeared first on Cyber Security News .
infrastructure Windows
The Windows giant  revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments.
Related: Decades-Old Windows Utility Powers Modern ClickFix Attack Ross Filipek, CISO at Corsica Technologies, says that before reconnecting with ConnectWise, affected organizations should have a clear understanding of what might have happened inside their environment.
organisation Storm-0940
The Windows giant  revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments.
"While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time," they said.
organisation Target
China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach.
Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise.
organisation Cyber Security News
The attackers abused stolen application credentials and permissions […] The post China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach appeared first on Cyber Security News .
The targeting count does not mean every tenant was […] The post Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise appeared first on Cyber Security News .
organisation Cloud Management
ConnectWise Service Disrupted ConnectWise suspended its Cloud Backup service and also took its SaaS Security and Cloud Management services offline following the incident.
The findings shed more light on the ConnectWise security incident , which saw the IT management vendor pull the plug on its Cloud Backup, SaaS Security, and Cloud Management services after discovering unauthorized access to application identities.
organisation State Bank of India Suffers
Related: State Bank of India Suffers a Customer PII Data Leak ConnectWise provides software and IT management technology that managed service providers use to deliver a broad range of services to their customers, including backup and recovery for Microsoft 365 data.
data_breach 365 data
Related: State Bank of India Suffers a Customer PII Data Leak ConnectWise provides software and IT management technology that managed service providers use to deliver a broad range of services to their customers, including backup and recovery for Microsoft 365 data.
organisation ConnectWise Breach
China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach.
organisation the ConnectWise Cloud Backup
China-state-aligned hackers used ARTEX, an AI-powered penetration-testing framework, to attempt access to more than 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach.
organisation Corsica Technologies
Related: Decades-Old Windows Utility Powers Modern ClickFix Attack Ross Filipek, CISO at Corsica Technologies, says that before reconnecting with ConnectWise, affected organizations should have a clear understanding of what might have happened inside their environment.
organisation Cloud Backup
ConnectWise Service Disrupted ConnectWise suspended its Cloud Backup service and also took its SaaS Security and Cloud Management services offline following the incident.
organisation AttackIQ
Jon Baker, vice president of threat informed defense at AttackIQ, wants affected organizations to preserve sign-in and audit records and to investigate application sign-ins, Microsoft Graph activity, new credentials, privilege changes and unusual data access.
organisation ConnectWise’s Cloud Backup
Storm-0940 initiated a widespread, but ultimately unsuccessful, password-spraying campaign immediately preceding the compromise of ConnectWise’s Cloud Backup service.
organisation ConnectWise Cloud Backup
Storm-0940 set its sights on ConnectWise the next day, using AI agents and the same malicious infrastructure to compromise a series of ConnectWise Cloud Backup customers’
organisation LinkedIn
“Since early October, a wave of AI-driven cyberattacks has been ongoing,” Igor Tsyganskiy, executive vice president at Microsoft, wrote in a LinkedIn post Wednesday.
‎Oct. 22
22 update, the company noted it was continuing work on restoring disrupted services and urged customers to keep affected ConnectWise application connections offline till further notice.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
Related: State Bank of India Suffers a Customer PII Data Leak ConnectWise provides software and IT management technology that managed service providers use to deliver a broad range of services to their customers, including backup and recovery for Microsoft 365 data.
The attackers used compromised application credentials associated with the service to attempt to access the Microsoft 365 environments of more than 2,250 downstream customer tenants.
Delivering these services requires the company to have authorized application access to customer Microsoft 365 environments to back up and restore data.
ConnectWise called on customers to review their individual Microsoft 365 environments using the company's technical investigation and remediation guide and related information.
Microsoft meanwhile highlighted its own mitigation and protection guidance, which included recommendations like reviewing every Microsoft 365 tenant that might have been tied to ConnectWise and to preserve logs and other forensic evidence before making any changes.
Organizations are going to need to investigate their Microsoft 365 environments are safe before they reconnect, he says.
Incident responders should know which applications connect to the organization's Microsoft 365 tenant and how to quickly sever those connections when necessary, and exercise that scenario with their service provider.
…y Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours China-aligned attackers used AI agents and compromised ConnectWise application credentials to target more than 2,250 Microsoft 365 tenants, Microsoft says.
The Windows giant  revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments.
Armed with ARTEX, Storm-0940 attempted to authenticate against more than 2,250 Microsoft 365 tenants, at times reaching 2,900 attempts a minute.
China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach.
China-state-aligned hackers used ARTEX, an AI-powered penetration-testing framework, to attempt access to more than 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach.
The attackers abused stolen application credentials and permissions […] The post China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach appeared first on Cyber Security News .
Microsoft researchers attributed the recent supply-chain attack targeting ConnectWise customers ’ Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940.
During a four-day stretch ending Oct. 14, Storm-0940 targeted 327 Microsoft 365 and Exchange Online accounts across eight organizations, researchers said.
Microsoft 365 environments.
Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise.
Hackers used AI agents and stolen ConnectWise application credentials to attempt access to more than 2,250 Microsoft 365 tenants, according to Microsoft’s technical investigation report.
The targeting count does not mean every tenant was […] The post Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise appeared first on Cyber Security News .
Metrics
data_breach
365
Data
Related: State Bank of India Suffers a Customer PII Data Leak ConnectWise provides software and IT management technology that managed service providers use to deliver a broad range of services to their customers, including backup and recovery for Microsoft 365 data.
Metrics
victims
2,250
Downstream Customer Tenants
The attackers used compromised application credentials associated with the service to attempt to access the Microsoft 365 environments of more than 2,250 downstream customer tenants.
The attackers abused stolen application credentials and permissions […] The post China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach appeared first on Cyber Security News .
Metrics
infrastructure
‎Windows
Affected Product
Related: Decades-Old Windows Utility Powers Modern ClickFix Attack Ross Filipek, CISO at Corsica Technologies, says that before reconnecting with ConnectWise, affected organizations should have a clear understanding of what might have happened inside their environment.
The Windows giant  revealed this week that the attackers, tracked as Storm-0940, used an open source AI penetration-testing tool called ARTEX to automate attacks against Microsoft 365 environments.
Intelligence Sources
Dark Reading 2026-10-22
AlienVault OTX 2026-10-27
CyberScoop 2026-10-21
AlienVault OTX 2026-10-22
The Register - CSO 2026-10-22