Microsoft says the Storm-0940 group used the ARTEX agent framework to automate attacks against hundreds of organizations, including downstream ConnectWise customers.
Microsoft’s threat intelligence teams say Storm-0940, a China-state-aligned actor, used the open-source ARTEX agentic penetration-testing framework to automate attacks against hundreds of organizations across multiple industries. The activity began as early as September 2026, and Microsoft assesses that the group was responsible for the recently disclosed ConnectWise supply-chain compromise involving a multi-tenant application. Microsoft published its findings on October 21.
ARTEX is a multi-agent system that can automate offensive security work from reconnaissance through attempted data exfiltration, with limited human interaction. Microsoft says Storm-0940 used it to accelerate scanning, reconnaissance, password spraying and abuse of OAuth applications. In the ConnectWise-related activity, the framework helped the actor attempt sign-ins to more than 2,250 downstream tenants. Microsoft also observed attempts to alter application credentials and privileges in some environments, activity that could enable expanded or persistent access. In several cases involving ARTEX-driven attacks, the actor reached privileged cloud access in less than three hours.
The report describes substantial activity, but distinguishes attempted access from confirmed compromise. A separate password-spraying campaign between October 10 and 14 generated more than 151,000 failed sign-in events targeting 327 accounts across eight organizations; Microsoft says it observed no successful authentication or related directory changes in that campaign. It also says the activity did not result from a compromise or vulnerability in Microsoft’s own systems, products or services, and that the presence of an affected application does not by itself establish that customer data was accessed or taken.
For defenders, the incident illustrates how autonomous tools can compress the time between reconnaissance and attempted privilege escalation, narrowing response windows. Microsoft advises customers to review service-principal sign-ins, investigate unexpected application credential or privilege changes, and follow ConnectWise’s containment guidance. Its post also describes detection and hunting queries intended to help investigate suspicious Microsoft Graph activity.