China-Linked Threat Actor Storm-0940 Uses AI Framework Artex to Automate ConnectWise Hacking Campaign

A China-linked threat actor known as Storm-0940 has been actively weaponizing an open-source artificial intelligence penetration testing framework named Artex to automate a sweeping cyberattack campaign. According to recent intelligence reports from Microsoft, the state-sponsored advanced persistent threat (APT) group has leveraged the agentic AI capabilities of the framework to scale up intrusions targeting ConnectWise infrastructure, impacting hundreds of organizations globally across a diverse range of critical sectors.

Tracked by security researchers since at least 2021, Storm-0940 has historically built its operations around conventional tactics, including aggressive password spraying and the exploitation of known vulnerabilities in internet-facing applications. The group has traditionally used these methods to breach enterprise networks across multiple industries. However, the introduction of the Artex framework has marked a significant evolution in the group’s operational tempo, allowing the threat actors to execute attacks at unprecedented machine speeds and scale.

The Evolution of Storm-0940 and Early AI-Powered Attacks

The transition toward automated, AI-assisted operations became visible in early September 2026. During this period, security researchers from CrowdStrike, Zscaler, and Recorded Future began observing malicious activity tied to the Artex framework, initially linking the tooling to targeted cyber intrusions directed at financial institutions in South Korea. These early campaigns demonstrated the threat actor’s growing capability to integrate autonomous agent workflows into traditional reconnaissance and exploitation pipelines.

Building upon these regional operations, Microsoft released intelligence detailing how Storm-0940 pivoted the Artex framework toward a massive supply chain and software ecosystem compromise involving ConnectWise customers in mid-October. The sheer velocity of the automated assaults prompted ConnectWise to take immediate defensive action, suspending several critical cloud services—including Cloud Backup, SaaS Security, and Cloud Management—to mitigate ongoing risks to its client base.

During the height of the October campaign, incident response firm Huntress observed threat actors successfully utilizing compromised ConnectWise application credentials to pierce the perimeters of hundreds of Microsoft 365 tenants. The intrusion scope was extensive, directly affecting more than 300 Entra tenants and illustrating the compounding risks associated with modern software supply chain dependencies.

Machine-Speed Reconnaissance and OAuth Abuse

Microsoft’s telemetry indicates that Storm-0940 relied heavily on the Artex framework to compress the timeline of standard attack phases, accelerating reconnaissance, password spraying, and OAuth application abuse into a continuous, rapid-fire process. In specific instances observed by Microsoft, the threat actor targeted over 300 accounts spread across eight distinct organizations at an astonishing velocity of more than 2,900 access attempts per minute.

Following the initial unauthorized access phase, the actor utilized Artex to attempt sign-ins targeting more than 2,250 separate corporate tenants. While OAuth application abuse has long been a staple of Storm-0940’s standard operational playbook, the integration of the AI-driven framework transformed a manual or semi-automated process into an industrial-scale operation executed at machine speed.

Microsoft’s security infrastructure captured more than 151,000 failed logon events tied directly to the wave of automated attacks. Despite the massive volume of blocked attempts, the threat actors successfully authenticated into several customer environments by hijacking the legitimate identities and credentials of multiple ConnectWise cloud applications.

Deep-Dive into Post-Authentication AI Activity

Once inside the targeted environments, the deployment of agentic AI within the Artex framework enabled the threat actors to move far beyond simple credential abuse. According to Microsoft’s technical assessment, the AI agents operating on behalf of Storm-0940 autonomously progressed past the authentication stage, directly interacting with Microsoft Graph and underlying directory operations.

The autonomous actions performed by the framework included rapid internal reconnaissance, the modification of application credentials to establish robust persistence, and unauthorized changes involving core identities, user groups, and privileged administrative roles. By dynamically altering application credentials within the directory services, the attackers ensured that they maintained persistent, backdoored access to the victims’ environments even after administrators attempted to remediate the initial application vulnerabilities.

To counter these sophisticated persistence mechanisms, Microsoft has advised security teams to thoroughly examine service principal sign-in logs alongside subsequent Microsoft Graph activity and directory modifications. Defenders are urged to closely correlate suspicious events with authorized administrative actions to identify hidden anomalies that standard automated monitoring tools might otherwise overlook.

Broad Industrial Impact and Technical Insights

The geographic and sector-agnostic scope of the Artex-enabled campaigns highlights the indiscriminate nature of modern threat actor operations when empowered by scalable automation. Since early September, Microsoft and other threat intelligence providers have tracked Storm-0940 using the framework in attacks against hundreds of organizations spanning a vast array of critical infrastructure and commercial sectors.

Impacted industries include aerospace, automotive, chemicals, defense, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, and technology. Furthermore, the automated campaigns have extended to non-profit organizations and policy-focused think tanks, demonstrating a wide strategic interest in political, industrial, and technological intelligence gathering.

To provide defenders with actionable intelligence, Zscaler published a comprehensive technical deep-dive analyzing Storm-0940’s AI-assisted hacking infrastructure. The research report outlines specific details regarding how the threat actor configures and deploys the Artex framework, including synchronization scripts, historical Claude Code prompt logs, and specialized network routing tools used to obscure the origin of the automated intrusions.