---
id: "2026-10-21-microsoft-storm-0940-artex-connectwise"
url: "https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/"
as_of: "2026-10-22T13:31:00+02:00"
date: "2026-10-21"
date_precision: day
category: policy-safety
importance: 4
confidence: high
status: [Confirmed]
sources: 1
editor: human editor
human_review: null
version: null
---

As of: 2026-10-22 13:31 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code), with a human editor. How we work: https://postcutoff.com/about/
Canonical page: https://postcutoff.com/e/2026-10-21-microsoft-storm-0940-artex-connectwise/

# Microsoft: China-aligned Storm-0940 used the ARTEX agentic AI hacking framework to compromise ConnectWise and hit 2,250+ Microsoft 365 tenants

Microsoft Threat Intelligence said on Oct 21, 2026 that Storm-0940, a China-state aligned actor, has used ARTEX, an open-source multi-agent LLM penetration-testing framework, since at least September to automate attacks on hundreds of organisations, reaching privileged cloud access in under 3 hours in several cases. Microsoft attributes the ConnectWise cloud-backup supply-chain compromise to the group; ARTEX agents then tried to sign in to more than 2,250 tenants at 2,900 attempts per minute.

## Key facts
- Actor: Storm-0940, 'a China-state aligned actor'; activity 'as early as September 2026', 'targeting hundreds of organizations globally across a broad range of industries'
- Speed: 'multiple instances where the time from initial targeting to privileged access was less than 3 hours'
- ARTEX: 'an open-source penetration testing framework that can use any AI model'; 'a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction'; multi-agent, written in Go
- Supply chain: Microsoft assesses Storm-0940 was responsible for the ConnectWise Cloud Backup compromise (ConnectWise advisory Oct 16, 2026); ARTEX used for scanning, password spraying and OAuth application abuse at downstream victims
- Scale: after the breach, ARTEX tried to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, then used stolen app credentials for Microsoft Graph reconnaissance, credential changes and privilege escalation attempts
- Microsoft: the activity 'did not result from a compromise of or a vulnerability in Microsoft corporate systems'
- Earlier: ARTEX had been linked by CrowdStrike (Oct 7) and Genians to the South Korean bank hacks

## What happened

Microsoft published a threat-intelligence report tying a China-aligned group to an AI-driven campaign. The group ran ARTEX, an open
agentic hacking framework that strings LLM agents through reconnaissance, credential attacks and exfiltration. After compromising
ConnectWise's multi-tenant cloud backup application, the agents used its trusted app identities to authenticate into customer
Microsoft 365 tenants without user sign-ins.

## Why it matters

It is a major vendor's public attribution of a large state-linked supply-chain intrusion run largely by AI agents, with machine
speed (2,900 sign-in attempts per minute, privileged access in under 3 hours) as the decisive advantage. It came on the same day as
PHP2Shell, the AI-found PHP flaw, and shows the attacker side of the "defender's window" debate.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 174 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 113 days after its cutoff
- Gemini 4 Argon (training cutoff March 2026): 204 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 143 days after its cutoff

## Sources

1. [Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) (microsoft.com, official)

## Changes

- 2026-10-22 (filed): Created (Techmeme)

## Related

- 2026-10-21: [PHP2Shell: critical remote-code-execution flaws in PHP, found with GPT-5.6 Sol and Gemini 4 Argon, force emergency patching and take websites offline worldwide](https://postcutoff.com/e/2026-10-21-php2shell-ai-found-php-rce/index.md)
- 2026-10-06: [South Korea's President Lee says AI appears to have been used in bank hacks affecting 68,000+ people; police investigate](https://postcutoff.com/e/2026-10-06-south-korea-ai-bank-hacks/index.md)
- 2026-10-02: [South Korea: AI agents suspected in Shinhan Bank breach of ~25,000 customers' data](https://postcutoff.com/e/2026-10-02-shinhan-bank-breach-ai-agent-suspected/index.md)