By the time ConnectWise’s security team noticed something was wrong on the morning of October 16, an AI agent had already moved through thousands of cloud environments, testing credentials at 2,900 attempts per minute, escalating privileges, and planting backdoors — sometimes within three hours of first contact. The threat actor was Storm-0940, a China-state-aligned hacking group active since 2021. The weapon was ARTEX, an open-source agentic AI penetration testing framework that anyone can download from GitHub. And the entry point was a supply-chain attack on ConnectWise, the IT management platform that sits at the center of thousands of enterprises’ cloud operations.
Microsoft published its full attribution on October 21, 2026, in what represents one of the most detailed public accounts of a nation-state AI-driven cyberattack to date. The numbers are arresting: more than 2,250 Microsoft 365 tenants reached, 151,000 failed logon attempts over four days of preliminary password spraying, and a speed of intrusion that compressed what typically takes human attackers weeks into a matter of hours.
What ARTEX Is — and Why It Matters
ARTEX describes itself as a penetration testing framework, which is true the same way a set of lockpicks is a locksmith’s tool. The framework is written in Go with a Next.js frontend and can connect to any large language model. Its interface supports English, Mandarin, Korean, Spanish, and Japanese — a detail that tells you something about its intended user base.
At its core, ARTEX is a multi-agent LLM system. Human operators provide an initial target and objective. From there, the system’s AI agents take over: running reconnaissance, mapping attack surfaces, executing password sprays, exploiting discovered vulnerabilities, and exfiltrating results — all with minimal human input. The agents record discovered assets and vulnerabilities in a graph as the attack progresses, building a live picture of the target environment in real time.
Microsoft Threat Intelligence is careful to note that Storm-0940 did not create ARTEX. Multiple threat actors from different regions are now using it. This is the key context: ARTEX is not a bespoke nation-state weapon. It is a commodity tool, and the barrier to entry for AI-accelerated intrusions has now dropped to the point where anyone with an API key and a target can run one.
The Attack: From Password Spray to Privilege Escalation
The sequence of events Microsoft reconstructed has an almost algorithmic quality to it.
Starting in September 2026, Storm-0940 began using ARTEX to probe organizations across a sweeping range of sectors: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, and technology. These were not opportunistic targets. This is the target list of a state intelligence operation.
Between October 10 and October 14, the group ran a password-spray campaign targeting 327 accounts across eight organizations. The campaign generated over 151,000 failed logon attempts, peaking at 2,900 per minute — a rate that Microsoft notes leaves defenders almost no reaction time. Microsoft observed no successful authentications during this phase.
Then the attack pivoted. On October 15, using the same infrastructure and AI agents, Storm-0940 exploited a compromised ConnectWise credential to authenticate directly to Microsoft 365 as a legitimate ConnectWise OAuth application — no user interaction required, and therefore no multi-factor authentication prompt to intercept.
ConnectWise’s Cloud Backup application, like most enterprise management tools, holds broad permissions across its customers’ Microsoft 365 environments: read and write access to email, OneDrive, SharePoint, and Teams. Those permissions were now Storm-0940’s permissions. The AI agents moved into Microsoft Graph and began directory operations: reconnaissance, adding application credentials for persistence, modifying identities, groups, and privileged roles. In several documented cases, the Cloud Management app granted itself the Global Administrator role. In at least one tenant, this persistence was established in approximately five minutes.
The Scope and What We Don’t Know
Microsoft reports that the ConnectWise-related activity reached more than 2,250 tenants. The company is careful to note that successful authentication does not necessarily mean data was accessed or stolen. Huntress, the security firm that first raised alarms on October 16, identified at least 162 compromised tenants in its own environment and saw suspicious role assignments in nearly 50 of those.
What we do not yet know is whether data was exfiltrated in the cases where Storm-0940’s agents achieved privileged access. ConnectWise stated it has “no indicators to date” that partner backup data was compromised. The gap between privilege escalation and confirmed exfiltration is where incident response investigations will be grinding for weeks.
ConnectWise shut down customer access to the affected services on October 17 at 05:01 UTC, disabled seven application identities, and began a phased restoration process. As of October 21, full service recovery was still pending. Notably, Microsoft warned that existing access tokens remain valid until they expire, and revoking user sessions does not terminate application-based access — meaning organizations that have not explicitly revoked the compromised applications’ credentials may still be exposed.
“A Wave of AI-Driven Cyberattacks”
Microsoft’s corporate vice president of security, Igor Tsyganskiy, framed the ConnectWise incident not as an isolated event but as a data point in a larger pattern. “A wave of AI-driven cyberattacks has been underway since early October,” he said, calling the ConnectWise incident “one of many.”
That framing is worth sitting with. A single campaign by a single group using one open-source AI framework reached 2,250 enterprise cloud environments in days. The password-spray phase alone logged more failed authentication attempts in four days than many security operations centers process in a year. And this is happening while the defensive use of AI in security operations is still nascent — most organizations’ threat detection is calibrated to human-speed attacks.
What ARTEX and similar tools represent is a structural shift in the economics of cyberattack: an attacker can now run an autonomous, persistent, multi-phase intrusion campaign with minimal staff, at machine speed, across thousands of targets simultaneously. The skill threshold for sophisticated attacks has dropped. The speed of intrusion has increased. The breadth of simultaneous targeting has expanded by orders of magnitude.
What Organizations Need to Do Now
Microsoft’s immediate remediation guidance focuses on the specific ConnectWise exposure: disable the implicated ConnectWise OAuth applications, review all application credential changes since October 13, audit other Cloud Management integrations, and examine any third-party OAuth applications holding Directory.ReadWrite.All or similarly broad permissions.
The broader lesson is structural. Third-party OAuth applications with high privileges are, functionally, backdoors — legitimate ones, until they’re not. Many organizations grant these permissions during vendor onboarding and never audit them again. When a supply chain is compromised, every application in that chain that holds administrative access to your environment becomes an attack surface.
Security professionals have been warning about privileged third-party OAuth applications for years. The ConnectWise attack is what that warning looks like when an AI agent finds and exploits it at 2,900 attempts per minute.
The playbook for the AI-era threat actor is now clear: use open-source agentic AI frameworks to compress reconnaissance and intrusion timelines, target the supply chain rather than the end customer directly, abuse legitimate application credentials to bypass MFA, and move fast enough that defenders don’t have time to respond before persistence is established. The question for defenders is whether their detection and response capabilities — many of which were built for human-speed attacks — can adapt quickly enough to meet it.
Microsoft has published detailed hunting queries and indicators of compromise in its threat intelligence report. Security teams should treat this incident as a live drill and audit their OAuth application inventory today.
