Microsoft links Storm-0940's ARTEX automation to ConnectWise supply-chain compromise

Microsoft said in a report published Oct. 21, 2026, that it assesses China-aligned Storm-0940 was responsible for the recently disclosed compromise of a ConnectWise multi-tenant application. The company says the group used ARTEX, an agentic AI penetration-testing framework that automates attack tasks, against hundreds of organizations globally as early as September.

Several ARTEX-driven attacks led to privileged access in cloud environments, according to Microsoft, and multiple cases took less than three hours from initial targeting to that access. Most targeting was unsuccessful, but Microsoft says the group established privileged cloud persistence at many organizations without providing an exact total.

How ARTEX accelerated the campaign

During the ConnectWise compromise, Microsoft says ARTEX accelerated scanning and reconnaissance, password spraying, and abuse of OAuth applications at downstream victims. Password spraying tries a small set of passwords across many accounts, while an OAuth application can hold credentials that authorize access to cloud services.

Microsoft says Storm-0940 has historically added credentials to existing OAuth applications to maintain access to Microsoft 365. The group has then used those applications and Microsoft Graph to access and exfiltrate email and other data, according to the company's account.

One campaign shows the authentication volume

From Oct. 10 through Oct. 14, 2026, Microsoft observed infrastructure at 144.172.64[.]99 target 327 accounts across eight organizations. Its telemetry recorded more than 151,000 failed logons, including a peak of 2,900 failures per minute on Oct. 11 and more than 111,000 failures that day.

Forty-eight accounts each received more than 1,000 failures, and lockout responses represented nearly 98% of the activity. Microsoft observed no successful authentication, token issuance, Microsoft Graph call, or directory change in that campaign.

The volume can generate alerts, but Microsoft says the speed leaves defenders little time to coordinate a response. The measured password-spray campaign produced no observed access, while other ARTEX-driven attacks did reach privileged cloud environments, so the outcomes should not be treated as interchangeable.