Microsoft says Storm-0940 used ARTEX AI to hit hundreds of orgs via ConnectWise

Microsoft says that as early as September 2026, Storm-0940, a China-state aligned actor, used the open-source agentic penetration testing framework ARTEX to automate attacks on hundreds of organizations across many industries. Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application, and that several of the ARTEX-driven attacks reached privileged cloud access in less than three hours. Microsoft says follow-on activity through Microsoft Graph included reconnaissance, application credential changes and attempts to modify privileges, and that the activity did not result from a compromise of Microsoft's own systems. It advises customers to review service principal sign-ins, investigate unexpected application credential or privilege changes, and follow ConnectWise's published containment guidance.