China-Linked Hackers Use ARTEX AI Agents to Accelerate ConnectWise Supply Chain Attacks
A China-linked cyberespionage group has used an artificial intelligence-powered penetration testing framework to accelerate attacks against organizations worldwide, demonstrating how autonomous agents are beginning to reshape sophisticated intrusion campaigns. Microsoft has attributed the activity to Storm-0940, a state-aligned threat actor that exploited the recent compromise of ConnectWise Cloud Backup to access downstream customer environments and conduct automated operations at a scale difficult to achieve through traditional manual techniques.
The attackers deployed ARTEX, a Go-based agentic AI framework originally developed for penetration testing, to automate reconnaissance, password spraying, cloud authentication abuse, and attempts to establish persistent access. According to Microsoft's investigation, the campaign has targeted hundreds of organizations across industries including aerospace, defense, finance, government, energy, manufacturing, and technology since September 2026. In several cases, the attackers reportedly progressed from initial targeting to privileged cloud access in less than three hours, highlighting the operational advantages that AI-assisted automation can provide.
The incident is particularly significant because the attackers did not rely exclusively on exploiting individual vulnerabilities. Instead, they combined automated identity attacks with compromised application credentials, allowing them to abuse trusted connections between ConnectWise services and customer environments. This approach demonstrates how a single compromised software provider can become an entry point into numerous organizations, while AI agents dramatically accelerate the process of identifying and exploiting available access paths. <Cite refs={["turn982405view0","turn324589view0"]}/>
ARTEX Enables Cyberattacks at Machine Speed
Storm-0940 has been active since at least 2021 and was previously associated with the Quad7 botnet, also known as CovertNetwork-1658, which has been used to conduct evasive password-spraying operations. The group's established methods involve exploiting internet-facing applications, compromising accounts, and manipulating cloud identities to maintain access. The adoption of ARTEX appears to extend these capabilities by allowing automated agents to coordinate multiple offensive activities with significantly less manual intervention.
Microsoft reported that the attackers used ARTEX to attempt authentication against more than 2,250 Microsoft 365 tenants, reaching approximately 2,900 sign-in attempts per minute. Between October 10 and 14, infrastructure associated with Storm-0940 conducted a password-spraying campaign targeting 327 accounts across eight organizations. During that period, Microsoft recorded more than 151,000 failed authentication events, including over 111,000 failures on October 11 alone.
Despite the volume of activity, Microsoft reported no successful authentication, token issuance, Microsoft Graph calls, or directory modifications during that particular password-spraying campaign. This distinction is important because it demonstrates that automation can generate enormous volumes of malicious activity without necessarily overcoming established security controls. However, it also illustrates the pressure that AI-assisted attacks place on defensive systems, which must detect, investigate, and respond to suspicious behavior occurring at extraordinary speed.
The situation changed on October 15, when the attackers obtained control of identities associated with multiple ConnectWise cloud applications. Rather than continuing to depend on password guessing, the AI agents began authenticating to customer environments through application identities that already possessed legitimate access. This allowed the attackers to exploit existing trust relationships without requiring an interactive user login, effectively transforming compromised application credentials into a mechanism for accessing downstream organizations.
Once authenticated, the agents reportedly performed reconnaissance through Microsoft Graph and directory services, modified application credentials, and attempted changes involving identities, groups, and privileged roles. These operations are especially concerning because changes to application credentials can establish persistence that survives the remediation of the original compromised application. An organization may revoke one compromised connection while leaving behind additional credentials or identities that attackers created during the intrusion.<Cite ref="turn982405view0"/>
ConnectWise Compromise Exposes the Risks of Trusted Cloud Integrations
The ConnectWise incident demonstrates how modern software supply chain attacks increasingly target identity relationships rather than simply distributing malicious code. Cloud applications frequently receive permissions to access customer environments through OAuth integrations and service identities. These permissions allow software providers to perform legitimate functions without repeatedly requiring users to authenticate, but they also create valuable opportunities for attackers who gain control of the underlying credentials.
In this campaign, Storm-0940 exploited precisely that relationship. By obtaining credentials associated with trusted ConnectWise applications, the attackers could attempt to operate inside customer tenants under identities that had already been authorized. Traditional security controls focused primarily on unusual user logins may struggle to identify this behavior because the activity originates from an application identity rather than an employee account.
The implications extend beyond the immediate compromise. Cloud environments often contain interconnected applications, service principals, automation workflows, and privileged identities that collectively determine who can access sensitive resources. When attackers gain control of one trusted integration, they may be able to investigate additional permissions, modify credentials, or establish alternative access paths. The resulting compromise can persist even after the initial application connection is disabled, particularly if administrators fail to identify unauthorized changes to the identity environment.
Managed service providers and technology vendors face additional exposure because their platforms frequently connect to many customer environments simultaneously. A compromise affecting one provider can therefore create opportunities for attackers to reach organizations across different industries and geographic regions. The value of such access is amplified when AI agents can automatically enumerate available tenants, identify useful permissions, and test potential escalation paths.
ConnectWise acknowledged that the activity reflected a broader campaign targeting software supply chains and temporarily suspended affected services while investigating the incident. The company subsequently began restoring services in phases, emphasizing the need to protect both software providers and the customers that depend on their integrations.
The case highlights a fundamental challenge in cloud security: trusted applications are not inherently trustworthy simply because they were previously authorized. Their permissions, credentials, and behavior must remain subject to continuous monitoring, particularly when those applications can access sensitive data or perform administrative operations across multiple environments. <Cite refs={["turn324589view0","turn982405view0"]}/>
AI-Assisted Intrusions Expand Beyond a Single Threat Actor
Microsoft's investigation also indicates that Storm-0940 is not the only group incorporating ARTEX into offensive operations. Researchers have identified activity involving the framework across multiple geographic regions, suggesting that agentic penetration testing tools are becoming increasingly attractive to threat actors with different objectives and technical capabilities.
Recorded Future's Insikt Group has tracked a separate cluster, identified as TAG-217, associated with attacks against South Korean financial institutions. Its investigation traced related activity to August 17, 2026, when the operators were testing remote-access infrastructure and conducting internet scanning. Subsequent research identified tools targeting cryptocurrency mining platforms, mobile operating systems, and other potentially valuable environments.
Zscaler ThreatLabz expanded on these findings by analyzing a customized ARTEX deployment containing AI assistant configurations, synchronization scripts, network routing tools, and Claude Code prompt histories. The framework was configured to use DeepSeek through an OpenAI-compatible gateway, while other configurations referenced GLM and Grok. Researchers found prompts instructing different AI models to divide investigative tasks and review one another's findings, suggesting an effort to use multiple agents to improve the reliability and efficiency of offensive operations.
The recovered prompts also revealed interest in personal information, financial transaction records, payment gateway credentials, NFT-related workflows, and unauthorized administrative access. Some requests concerned the potential sale of stolen data, leading researchers to assess that portions of the observed activity were financially motivated. These findings should not be interpreted as evidence that every ARTEX operation belongs to the same campaign or threat actor, but they demonstrate the framework's broader appeal across different forms of cybercrime and cyberespionage.
The use of multiple AI models introduces another dimension to the threat. Rather than depending on a single assistant to perform an entire operation, attackers can assign different tasks to specialized agents, compare their findings, and coordinate the results through automated workflows. Such systems may accelerate reconnaissance and technical troubleshooting while allowing human operators to concentrate on strategic decisions and high-value targets.
Although these capabilities do not eliminate the limitations of AI-generated analysis, they can substantially reduce the time required to investigate complex environments. The greatest advantage may not be the discovery of entirely new attack techniques, but the ability to execute established techniques continuously, simultaneously, and at a scale that overwhelms conventional response processes.<Cite ref="turn324589view0"/>
Defending Against AI-Accelerated Supply Chain Attacks
The ConnectWise campaign illustrates why organizations must extend their security monitoring beyond conventional user authentication. Applications and service principals can possess extensive permissions within cloud environments, yet their activities may receive less scrutiny than interactive employee sessions. When attackers compromise these identities, they can potentially perform sensitive operations without triggering the same controls designed to identify suspicious user logins.
Microsoft recommends that affected organizations review their ConnectWise integrations, investigate service principal authentication activity, and examine Microsoft Graph operations for unauthorized changes. Particular attention should be given to unexpected application credentials, new privilege assignments, unfamiliar application owners, and modifications to directory identities. These changes can provide persistent access even after the originally compromised integration has been disabled.
Organizations should preserve relevant audit records before removing affected applications or making irreversible configuration changes. They should also verify that suspicious activity originated from unauthorized infrastructure rather than relying exclusively on published indicators of compromise. Microsoft cautions that the presence of an affected application, or even successful authentication, does not automatically establish that customer information was accessed or exfiltrated.
More broadly, the incident reinforces the importance of applying least-privilege principles to third-party cloud integrations. Applications should receive only the permissions required for their intended functions, and privileged access should be continuously reviewed. Monitoring service principal sign-ins, credential additions, OAuth consent grants, and unusual Microsoft Graph activity can help identify compromises that traditional endpoint-focused defenses may overlook.
The defensive challenge is increasingly one of speed. AI agents can perform reconnaissance, test credentials, and investigate cloud permissions continuously, reducing the time available for human analysts to recognize and contain suspicious behavior. Security operations must therefore combine automated detection with well-defined containment procedures capable of responding before attackers establish additional persistence mechanisms.
Storm-0940's campaign demonstrates that agentic AI does not need to invent new vulnerabilities to fundamentally change the operational impact of cyberattacks. By combining established intrusion techniques with automated decision-making and compromised cloud identities, attackers can exploit trusted software relationships at unprecedented speed.
The broader lesson is that enterprise security must account for both the identities granted access to cloud environments and the automation capable of abusing those identities. As AI agents become more deeply integrated into offensive operations, defending trusted application connections may become just as important as protecting the users who depend on them.