Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application.
During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims.
The tech giant said the threat actor used the AI tool at "machine speed" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026. Targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.
"Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in," Microsoft said.
"AI-accelerated follow-on activity included reconnaissance, application credential changes, and attempts to modify privileges that could enable expanded or persistent access."
Storm-0940 was first detailed by Microsoft in November 2024, revealing that the threat actor has been leveraging a botnet called Quad7 (aka CovertNetwork-1658) to conduct highly evasive password spray attacks. The threat actor is assessed to be active since at least 2021.
The adversary is also said to exploit internet-facing applications to gain initial access, followed by using compromised accounts to move through targeted environments. It has also been observed establishing persistence by adding credentials to existing OAuth applications within cloud infrastructures to ensure access to Microsoft 365 resources.
According to Microsoft, a chunk of these ARTEX-driven attacks have resulted in the adversary gaining privileged access to an organization's cloud infrastructure, including several instances where the time frame from initial targeting to privileged access was less than 3 hours.
In the case of the ConnectWise incident, Storm-0940 has been observed using ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace the company said gives defenders a short window to detect and respond.
"Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64[.]99 conducted an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations to gain access to Microsoft 365 and Exchange Online," Microsoft said.
During this window, Microsoft said it captured over 151,000 failed logon events. The activity peaked on October 11 at 2,900 failures per minute, resulting in more than 111,000 failures in a single day. Of these, 48 accounts received more than 1,000 failures. No successful authentication, token issuance, Graph call, or directory change was detected, it noted.
That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments.
"Additionally, after acquiring control of the identities of multiple ConnectWise cloud applications, the AI agents operating on behalf of the threat actor continued to use the same IP range to authenticate to customer environments using the illicit access acquired through these stolen app credentials, effectively taking advantage of the already established trust by these apps within a tenant," the tech giant added.
In some of these cases, the AI agents are assessed to have progressed beyond authentication to Microsoft Graph and directory operations. This included reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles.
"The application credential modification made by Storm-0940’s associated agents in the targeted victims' environments can lead to persistence through other identities, credentials, and cloud services," Microsoft said. "These changes can remain active as a backdoor even after the original compromised application is mediated."
Storm-0940 is far from the only hacking crew to rely on ARTEX. Microsoft said it has observed threat actors across multiple geographic regions weaponizing the framework in their operations.
Recorded Future Insikt Group, which is tracking the threat cluster behind the attacks on South Korean financial institutions under the moniker TAG-217, said it identified activity linked to the threat actor dating back to August 17, 2026, when it "tested infrastructure designed to maintain remote access to computers and conducted internet scanning."
Over the next few weeks, the Chinese-speaking threat actor is said to have put together tools to attack cryptocurrency mining operations using the YiiMP platform, as well as set up a workspace for testing weaknesses in iPhones and modifying Android system software.
Zscaler ThreatLabz has since revealed that the attack's footprint extends beyond South Korea, and that it opportunistically targeted organizations around the globe and across multiple industry sectors. The findings come from a custom ARTEX deployment that included AI assistant configurations, synchronization scripts, network routing tools, and a Claude Code prompt history.
"ARTEX was configured to use a DeepSeek model through an OpenAI-compatible gateway, but other configurations also specified DeepSeek, GLM, and Grok," security researcher Seongsu Park said. "Prompts directed AI models to divide investigation tasks and review one another's findings, including instructions for GLM to review work performed by DeepSeek and its subagents."
An analysis of the prompt histories has revealed requests for bulk personal and transaction data, along with questions about selling stolen data, suggesting the attacks were likely financially motivated. Other prompts related to extracting payment gateway API keys, exploiting NFT minting workflows, and gaining unauthorized administrative privileges.
The findings once again highlight how threat actors are increasingly integrating agentic AI tools into their offensive security workflows to quickly carry out attacks at scale.
"Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously, enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises," Microsoft said.
In response to the findings, ConnectWise said the activity "describes a campaign that reaches well beyond any one company," adding "nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations."
"AI now lets them test those connections at [...] 'machine speed.' MSPs are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve. Every vendor and every MSP must defend itself with both of those risks in mind."
ConnectWise, which temporarily shut down services following the attacks, has been restoring services in phases, a process that it said will take several days.
