On October 21, 2026, Microsoft's Security Threat Intelligence (MSTIC) team published research showing that Storm-0940, a China-state-aligned threat actor active since 2021, had used an open-source agentic AI pentesting framework called ARTEX to automate a supply chain attack targeting over 2,250 Microsoft 365 tenants through ConnectWise's Cloud Backup application.
This matters beyond the headline numbers. It is the clearest public documentation yet of a nation-state actor integrating AI agent tooling into an active offensive campaign.
What is ARTEX
ARTEX is an open-source, multi-agent AI pentesting framework written in Go with a Next.js frontend. It supports any LLM backend and can run autonomous penetration tests from reconnaissance through data exfiltration with minimal human oversight. It is publicly available on GitHub. No specialized infrastructure required.
Storm-0940 did not build a custom AI tool. They picked up an existing one and aimed it at ConnectWise's customer base.
How the attack worked
The actor gained control of identities for several ConnectWise Cloud Backup applications. Those applications hold trusted, high-privilege credentials that let them authenticate to customer Microsoft 365 tenants without interactive user sign-in. No phishing. No MFA prompt. The app just authenticates as itself, and the tenant is already set up to trust it.
ARTEX automated the next steps at machine speed: password spraying, Graph API reconnaissance, application credential changes, and privilege escalation. In one campaign running October 10 through 14, Microsoft logged more than 151,000 failed sign-in attempts against 327 accounts at eight organizations, at up to 2,900 attempts per minute. In several cases, the actor achieved privileged cloud access within three hours of first contact.
In at least one instance, a compromised ConnectWise application assigned itself the Global Administrator role.
The supply chain angle
The victims in this campaign were not Storm-0940's primary target. ConnectWise was. By compromising ConnectWise's application infrastructure, the actor gained a position inside the trust relationships that ConnectWise's customers had already established. Microsoft describes this as a supply chain compromise because the initial breach occurred upstream, then propagated through legitimate app connections.
This is not a ConnectWise-specific problem. It is a structural property of any system where third-party applications hold persistent, high-privilege access to customer environments. When the third party's credentials are compromised, every downstream customer is exposed through no fault of their own.
What to do if you are a ConnectWise customer
Microsoft's guidance: disable affected ConnectWise Cloud Backup app connections until ConnectWise issues restoration instructions. Do not delete the enterprise application as a first response; preserve it for forensic review. Preserve sign-in logs and audit records before making irreversible changes.
Review service principal sign-ins from at least October 15, 2026. Look for new application credentials, unusual role assignments, consent grants, and unexpected Microsoft Graph or mailbox activity. Microsoft published specific Defender XDR detection rules, advanced hunting queries, and IOCs including the 144.172.64.x infrastructure range.
The broader implication
Storm-0940 used a free, publicly available tool. The barrier to running AI-augmented attacks at this scale is no longer a nation-state's private R&D budget. Any attacker with a working set of compromised credentials and access to an LLM API key can run the same automation.
The delta between a sophisticated nation-state operation and a well-equipped criminal group is shrinking. That changes the threat model for every organization that holds data worth stealing.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are assessing your Microsoft 365 exposure to supply chain identity attacks.