China-Linked Threat Actor Storm-0940 Leverages AI Framework Artex to Accelerate Global Cyberattacks

A sophisticated China-linked threat actor, identified by Microsoft as Storm-0940, has significantly ramped up its offensive capabilities by integrating the open-source artificial intelligence penetration testing framework known as Artex into its operational toolkit. This strategic adoption of agentic AI has enabled the group to automate large-scale intrusion campaigns, most notably a recent supply-chain compromise targeting ConnectWise customers. The shift toward machine-speed exploitation marks a concerning evolution in the tactics, techniques, and procedures (TTPs) of state-sponsored actors, as they move away from manual labor toward high-velocity, AI-augmented attacks.

The Rise of Storm-0940 and the Artex Framework

Active since at least 2021, Storm-0940 has established a reputation for its methodical approach to cyber espionage and unauthorized access. The group has historically focused on traditional methods, including password spraying—the process of testing common passwords against a large number of user accounts—and the exploitation of known vulnerabilities within internet-facing applications. By targeting organizations across a diverse array of sectors, the group has proven its ability to bypass standard perimeter defenses.

However, the landscape of their operations shifted dramatically in early September 2026, when security researchers began observing the group utilizing Artex. Artex, designed as an open-source framework for legitimate penetration testing, has been repurposed by Storm-0940 to automate various phases of the kill chain. Prior investigations conducted by firms such as CrowdStrike, Zscaler, and Recorded Future had already linked this specific AI-driven methodology to a series of targeted attacks against South Korean financial institutions. These early signs of AI integration were indicative of a broader trend: threat actors are increasingly leveraging generative AI and agentic tools to reduce the time-to-compromise and minimize the human effort required to breach hardened networks.

The ConnectWise Supply Chain Compromise

The most recent and high-profile manifestation of this new tactic occurred in mid-October, when Storm-0940 utilized Artex to automate intrusions into environments managed by ConnectWise. The scale and speed of the operation prompted an immediate crisis response, forcing ConnectWise to suspend several critical cloud-based services, including Cloud Backup, SaaS Security, and Cloud Management, to prevent further unauthorized access.

Security firm Huntress, which monitored the incident closely, reported that the attackers successfully leveraged compromised ConnectWise application credentials to gain access to hundreds of Microsoft 365 tenants. The breadth of the breach was substantial, affecting more than 300 Entra tenants. By compromising a central management provider, the threat actors gained a "force multiplier" effect, allowing them to pivot from the supply chain provider into the downstream environments of their customers.

Microsoft’s analysis of the incident reveals that Storm-0940 relied on Artex to accelerate every stage of the attack, from initial reconnaissance to the abuse of OAuth applications. The automation was relentless; the threat actor hit over 300 accounts across eight distinct organizations at an astonishing pace of more than 2,900 attempts per minute.

"Following the unauthorized access, Storm-0940 used Artex to attempt to sign-in to more than 2,250 tenants," Microsoft stated in its findings. "While OAuth application abuse is a typical part of Storm-0940’s toolset, in this case, the actor used Artex to accelerate the activity to machine speed."

Operational Depth and Persistence

The sheer volume of activity generated by the AI agents was overwhelming. Microsoft captured more than 151,000 failed logon events during the campaign, yet the sheer speed of the automation allowed the attackers to identify and exploit successful authentication paths. Once they had secured access to a customer environment using the identities of legitimate ConnectWise cloud applications, the AI agents did not stop at simple entry.

According to Microsoft, the agents autonomously progressed into the victim environments to conduct complex operations via the Microsoft Graph API. These operations included deep internal reconnaissance, modifications to application credentials to ensure persistent access, and the manipulation of identities, groups, and privileged roles. By altering application credentials, the attackers effectively locked in their presence, ensuring that even if the primary vulnerability was patched or the initial entry point was remediated, they maintained a "backdoor" to the compromised network.

Microsoft has issued a stern warning to organizations affected by or potentially exposed to such tactics. The company advises IT and security teams to conduct a rigorous examination of service principal sign-ins, paying close attention to subsequent Microsoft Graph activity. It is crucial for organizations to correlate these automated directory changes and resource access requests with authorized administrative activity to distinguish between legitimate system maintenance and malicious actor intervention.

A Global Campaign Across Diverse Sectors

The scope of Storm-0940’s campaign extends far beyond the ConnectWise incident. Since early September, the group has deployed Artex in automated attacks against hundreds of organizations across a wide spectrum of critical sectors. The list of targets identified by Microsoft reads like a blueprint of modern infrastructure, encompassing aerospace, automotive, chemicals, defense, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, and technology industries. Furthermore, the group has targeted non-profit organizations and high-profile think tanks, suggesting that the motive remains rooted in intelligence gathering and strategic positioning.

The sophistication of these attacks was further highlighted this week by Zscaler, which published a comprehensive technical deep-dive into Storm-0940’s AI-assisted operations. The report provides a rare look at the inner workings of the campaign, detailing the specific configurations used by the threat actor, synchronization scripts that orchestrate the AI agents, and even the history of Claude Code prompts used to drive the automation. The research also highlighted the group’s use of advanced network routing tools designed to obfuscate the source of the traffic and evade detection by traditional signature-based security systems.

The integration of Artex into Storm-0940’s workflow represents a pivotal moment in the current threat landscape. The combination of established espionage tactics with the speed and adaptability of AI agents allows threat actors to conduct large-scale, persistent campaigns that were previously beyond the reach of all but the most well-resourced organizations. As the use of agentic AI continues to lower the barrier for sophisticated cyber operations, the defensive community is faced with the challenge of developing counter-AI strategies that can match the speed and complexity of these automated threats.

For now, the situation remains fluid. Organizations operating within the affected sectors, particularly those relying on third-party management software or integrated cloud services, are urged to review their security posture, enforce strict OAuth application governance, and remain vigilant against anomalous activity originating from service principals and privileged administrative accounts. The transition to machine-speed hacking is not a theoretical future scenario; it is a reality that is currently reshaping the defense of the global digital ecosystem.