{"schema":"postcutoff/event@1","as_of":"2026-10-22T13:31:00+02:00","url":"https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/","md":"https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"human editor","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-21-microsoft-storm-0940-artex-connectwise","date":"2026-10-21","date_precision":"day","short_title":"Microsoft: China-aligned Storm-0940 used the ARTEX agentic AI hacking framework to compromise ConnectWise and hit 2,250+ Microsoft 365 tenants","deck":null,"takeaway":"Microsoft attributes the ConnectWise cloud-backup supply-chain compromise to the group; ARTEX agents then tried to sign in to more than 2,250 tenants at 2,900 attempts per minute.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise","url":"https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/","type":"official","group":"primary","domain":"microsoft.com"}],"official":1,"filed":"2026-10-22","updated":"2026-10-22","orgs":["Microsoft","ConnectWise"],"title":"Microsoft: China-aligned Storm-0940 used the ARTEX agentic AI hacking framework to compromise ConnectWise and hit 2,250+ Microsoft 365 tenants","summary":"Microsoft Threat Intelligence said on Oct 21, 2026 that Storm-0940, a China-state aligned actor, has used ARTEX, an open-source multi-agent LLM penetration-testing framework, since at least September to automate attacks on hundreds of organisations, reaching privileged cloud access in under 3 hours in several cases. Microsoft attributes the ConnectWise cloud-backup supply-chain compromise to the group; ARTEX agents then tried to sign in to more than 2,250 tenants at 2,900 attempts per minute.","key_facts":["Actor: Storm-0940, 'a China-state aligned actor'; activity 'as early as September 2026', 'targeting hundreds of organizations globally across a broad range of industries'","Speed: 'multiple instances where the time from initial targeting to privileged access was less than 3 hours'","ARTEX: 'an open-source penetration testing framework that can use any AI model'; 'a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction'; multi-agent, written in Go","Supply chain: Microsoft assesses Storm-0940 was responsible for the ConnectWise Cloud Backup compromise (ConnectWise advisory Oct 16, 2026); ARTEX used for scanning, password spraying and OAuth application abuse at downstream victims","Scale: after the breach, ARTEX tried to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, then used stolen app credentials for Microsoft Graph reconnaissance, credential changes and privilege escalation attempts","Microsoft: the activity 'did not result from a compromise of or a vulnerability in Microsoft corporate systems'","Earlier: ARTEX had been linked by CrowdStrike (Oct 7) and Genians to the South Korean bank hacks"],"key_numbers":[],"tags":["cybersecurity","agentic-ai","artex","china","nation-state","supply-chain","microsoft-365","ai-misuse"],"science":null,"body_md":"## What happened\n\nMicrosoft published a threat-intelligence report tying a China-aligned group to an AI-driven campaign. The group ran ARTEX, an open\nagentic hacking framework that strings LLM agents through reconnaissance, credential attacks and exfiltration. After compromising\nConnectWise's multi-tenant cloud backup application, the agents used its trusted app identities to authenticate into customer\nMicrosoft 365 tenants without user sign-ins.\n\n## Why it matters\n\nIt is a major vendor's public attribution of a large state-linked supply-chain intrusion run largely by AI agents, with machine\nspeed (2,900 sign-in attempts per minute, privileged access in under 3 hours) as the decisive advantage. It came on the same day as\nPHP2Shell, the AI-found PHP flaw, and shows the attacker side of the \"defender's window\" debate.","disputed":[],"related":[{"id":"2026-10-21-php2shell-ai-found-php-rce","url":"https://postcutoff.com/e/2026-10-21-php2shell-ai-found-php-rce/","date":"2026-10-21","date_precision":"day","short_title":"PHP2Shell: critical remote-code-execution flaws in PHP, found with GPT-5.6 Sol and Gemini 4 Argon, force emergency patching and take websites offline worldwide","deck":null,"takeaway":"The bugs were found with frontier AI: by Calif with GPT-5.6 Sol under OpenAI's Patch the Planet programme, and by Google's Wiz with Gemini 4 Argon, GPT-5.6 Sol and its Wiz Atlas agent.","category":"policy-safety","category_label":"Policy & safety","importance":5,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":7,"official":4,"filed":"2026-10-22","updated":"2026-10-22","orgs":["OpenAI","Wiz","Google","PHP"]},{"id":"2026-10-06-south-korea-ai-bank-hacks","url":"https://postcutoff.com/e/2026-10-06-south-korea-ai-bank-hacks/","date":"2026-10-06","date_precision":"day","short_title":"South Korea's President Lee says AI appears to have been used in bank hacks affecting 68,000+ people; police investigate","deck":null,"takeaway":"It is one of the first times a head of state has publicly linked a wave of attacks on financial institutions to AI models.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":8,"official":1,"filed":"2026-10-06","updated":"2026-10-09","orgs":["Government of South Korea"]},{"id":"2026-10-02-shinhan-bank-breach-ai-agent-suspected","url":"https://postcutoff.com/e/2026-10-02-shinhan-bank-breach-ai-agent-suspected/","date":"2026-10-02","date_precision":"day","short_title":"South Korea: AI agents suspected in Shinhan Bank breach of ~25,000 customers' data","deck":"President orders full probe as more banks disclose hacks","takeaway":"It is one of the first national-scale banking incidents in which officials publicly raised autonomous AI hacking as a likely cause, weeks after frontier-lab agents were found breaching government systems in Australia.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":6,"official":1,"filed":"2026-10-05","updated":"2026-10-09","orgs":["Shinhan Bank","Financial Services Commission (Korea)"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-22","type":"filed","text":"Created (Techmeme)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-22","run":null,"sources_read":null,"updated":"2026-10-22","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":174,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":113,"in_training_data":false},{"model_id":"gemini-4-argon","name":"Gemini 4 Argon","cutoff":"2026-03","days_after":204,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":143,"in_training_data":false}],"short_url":"https://postcutoff.com/s/microsoft-china-aligned"}