A China-aligned group called Storm-0940 used an open-source AI pentest tool, ARTEX, against hundreds of organizations, and is assessed to be behind the ConnectWise supply chain compromise, Microsoft said in a security blog post. In some cases, getting from targeting to privileged access took under three hours.

What Microsoft says happened

  • The actor: Microsoft says Storm-0940 has been active since 2021 and steals data across industries. It has relied on password spraying and internet-facing apps, and in the cloud it has added credentials to existing OAuth applications.
  • The tool: ARTEX is a multi-agent system that runs autonomous pentests from reconnaissance through data exfiltration, storing assets and vulnerabilities in a graph. Microsoft says the actor used it to "accelerate the activity to machine speed".
  • The timing: Microsoft says the group has used ARTEX since at least September 2026. It assesses the same actor was responsible for the ConnectWise compromise.
  • Observed activity: A password-spray run from 144.172.64.99 hit 327 accounts at eight organizations from Oct 10 to 14, with over 151,000 failed logons and no successful sign-in. Separately, Microsoft saw sign-ins followed by Graph activity in several customer environments, including reconnaissance, credential changes and attempts to change privileges. Some privileged access was obtained.

Microsoft also says the majority of the targeting was not successful. It says none of this came from a compromise of, or flaw in, its own systems, products or services.

What is still unclear

Public reports began Oct 15, and Microsoft says ConnectWise published an initial advisory on Oct 16.

Microsoft cautions that an affected app or a successful sign-in "does not necessarily indicate" data was accessed or stolen.

What ConnectWise customers should do

This is Microsoft's guidance:

  • Keep affected ConnectWise connections disabled until ConnectWise issues formal restoration instructions.
  • Do not delete enterprise apps first. Preserve their configuration and evidence.
  • Search by application ID, not display name, in every tenant where the app is installed.
  • Keep Entra sign-in and audit logs, Purview audit data and SIEM data.
  • Review activity from at least Oct 15, and service-principal sign-ins back to Oct 1 where possible.
  • In Entra audit logs, look for new credentials, owners, app-role assignments and privileged role changes.
  • Revoke permissions you do not need, and rotate credentials where activity looks suspicious.
  • Apply least privilege to multi-tenant app permissions and consent grants.

Why it matters

In our view, the notable part is speed. A password-spray run and a quick path to admin rights are old tricks, but an agent that chains them without a person at the keyboard shortens the window defenders have to react. That is our reading of Microsoft's account, not a finding it states.

In our view, managed service providers and their customers are a natural target, since one compromised connection can reach many tenants. That is our inference.

Context

For related security coverage, see our story on Railway env vars and rotating secrets.

For more on the machines and software behind these stories, see Computing.