Microsoft Ties Storm-0940 to ARTEX-Driven ConnectWise Hack

ARTEX is open-source, multilingual, and written in Go with a .js frontend, making the toolchain accessible to nation-state actors well beyond Storm-0940.

Microsoft documents 15-plus victim sectors including aerospace, defense, semiconductors, and government, indicating automated rather than hand-curated target selection.

151,000 failed sign-ins over four days preceded the ConnectWise pivot; once four OAuth app credentials were stolen, 2,250 tenants fell in minutes.

In some cases, Microsoft says, attackers achieved "privileged access to an organization's cloud infrastructure" in "less than 3 hours" from initial targeting.

The disclosure came Wednesday from Microsoft, which tied the recent ConnectWise Cloud Backup supply chain compromise to a China state-aligned actor it tracks as Storm-0940. The group ran the operation through ARTEX, a Go-based agentic AI penetration testing framework that was pushed closed-source after being abused in attacks on South Korean financial institutions.

Between October 10 and 14, 2026, Microsoft says infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations, generating more than 151,000 failed logon events. Activity peaked October 11 at 2,900 failures per minute, with 111,000 failures in that single day across more than 2,250 tenants. On October 15 the agents obtained identities of multiple ConnectWise cloud applications and used them to authenticate into customer environments.

"Agents are not constrained by factors affecting humans," Microsoft wrote; they can "work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously." The company said the ARTEX activity let Storm-0940 "authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in."

Zscaler ThreatLabz researcher Seongsu Park reported ARTEX configurations pointing at DeepSeek, GLM, and Grok through OpenAI-compatible gateways, with prompts that "directed AI models to divide investigation tasks and review one another's findings." Recorded Future's Insikt Group is tracking a related Chinese-speaking cluster that has gone after South Korean banks as TAG-217. The campaign has run since September 2026 against tenants in aerospace, defense, energy, government, semiconductor, software, and think tanks. It lands on a busy day for our cybersecurity tracker .

What others are reporting

Coverage cluster as of 8h after publish

Microsoft Security Read → First-party attribution; names 15-plus victim sectors and documents ARTEX's Go/ .js multi-agent architecture, multilingual support, and the precise October 10-14 campaign timeline. time from initial targeting to privileged access was less than 3 hours

First-party attribution; names 15-plus victim sectors and documents ARTEX's Go/ .js multi-agent architecture, multilingual support, and the precise October 10-14 campaign timeline.

time from initial targeting to privileged access was less than 3 hours

The Register Read → Flags this as ConnectWise's second major breach in 18 months, adds CEO Manny Rivelo's containment statement, and reports ARTEX is already in use by multiple threat actors beyond Storm-0940. AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours

Flags this as ConnectWise's second major breach in 18 months, adds CEO Manny Rivelo's containment statement, and reports ARTEX is already in use by multiple threat actors beyond Storm-0940.

AI agents did the dirty work, with hackers gaining privileged access in some environments in under three hours

CSO Online Read → Centers the defender gap via IDC analyst commentary: automated token revocation and credential disabling are now table stakes, with manual approval workflows no longer viable at this attack velocity. 2,900 sign-in attempts per minute and gaining privileged cloud access in under three hours is not a timeline any human analyst queue can keep up with

Centers the defender gap via IDC analyst commentary: automated token revocation and credential disabling are now table stakes, with manual approval workflows no longer viable at this attack velocity.

2,900 sign-in attempts per minute and gaining privileged cloud access in under three hours is not a timeline any human analyst queue can keep up with

Originally reported by thehackernews.com

Original headline: Microsoft Ties Storm-0940 to ARTEX-Driven ConnectWise Supply-Chain Compromise Across 2,250 M365 Tenants