China-Linked Threat Actor Storm-0940 Uses Open-Source AI Framework Artex in Massive ConnectWise Supply Chain Campaign

A China-linked advanced persistent threat (APT) group has been actively weaponizing an open-source artificial intelligence penetration testing framework known as Artex to automate a sweeping hacking campaign targeting hundreds of high-profile organizations globally, according to a comprehensive new advisory published by Microsoft.

The threat actor, tracked by Microsoft Threat Intelligence under the moniker Storm-0940, has maintained an active presence in the cyber espionage and intrusion landscape since at least 2021. The group has traditionally built its operational reputation on conventional tradecraft, heavily relying on techniques such as password spraying and the aggressive exploitation of vulnerable, internet-facing enterprise applications to breach corporate networks across a wide array of critical industry sectors.

However, recent telemetry indicates a significant evolution in the group’s capabilities. Beginning in early September 2026, security researchers observed Storm-0940 integrating the Artex framework into its operational infrastructure to dramatically accelerate and automate its attack lifecycles. Prior threat intelligence reports published by prominent cybersecurity firms including CrowdStrike, Zscaler, and Recorded Future had already begun linking this emerging AI-powered activity to sophisticated cyber operations targeting major financial institutions in South Korea.

The scope of the campaign widened significantly in mid-October 2026, when Microsoft documented Storm-0940 leveraging Artex to orchestrate automated intrusions directly targeting the customer environments of IT management software provider ConnectWise. The scale and velocity of the attacks prompted swift defensive measures, leading ConnectWise to temporarily suspend several core cloud services—including Cloud Backup, SaaS Security, and Cloud Management—to mitigate potential exposure and protect downstream customers.

Concurrently, threat intelligence firm Huntress observed the threat actors successfully exploiting compromised ConnectWise application credentials to gain unauthorized access to hundreds of Microsoft 365 tenants, affecting over 300 Entra tenants alone. According to Microsoft’s analytical findings, the adversary relied on the Artex framework to execute high-speed reconnaissance, conduct exhaustive password-spraying operations, and systematically abuse OAuth applications at machine speed.

The automated nature of the intrusions allowed the threat actors to target over 300 accounts spread across eight distinct organizations at an astonishing operational pace, sustaining more than 2,900 access attempts per minute. Microsoft noted that following the initial unauthorized access phases, Storm-0940 utilized Artex to attempt sign-ins across more than 2,250 separate tenant environments. While OAuth application abuse has long been a standard component of Storm-0940’s traditional operational toolset, the integration of Artex transformed the campaign, allowing the hackers to execute these maneuvers at unprecedented, automated velocities.

In total, Microsoft’s telemetry captured upwards of 151,000 failed logon events directly associated with the aggressive wave of attacks. Despite the massive volume of blocked attempts, the security giant also documented numerous instances of successful authentication into customer environments using the stolen identities of multiple legitimate ConnectWise cloud applications.

Moving beyond simple credential harvesting, Microsoft observed that in several compromised environments, autonomous AI agents operating on behalf of the threat actor progressed far beyond initial authentication. These agents initiated direct interactions with the Microsoft Graph API and executed complex directory operations. Their activities included deep internal reconnaissance, the modification of application credentials to establish long-term persistence, and unauthorized changes to enterprise identities, security groups, and highly privileged user roles.

By proactively altering application credentials within victim environments, the attackers ensured sustained, persistent access to compromised corporate networks even after the underlying vulnerable applications were patched, remediated, or taken offline. Microsoft has issued stern warnings to corporate security teams, emphasizing that threat actors are successfully maintaining backdoors through these subtle directory modifications.

To counteract these persistent threats, the technology giant recommends that organizations thoroughly examine service principal sign-in logs alongside subsequent Microsoft Graph activity, directory alterations, and internal resource access patterns. Security analysts are advised to carefully correlate suspicious events against known, authorized administrative workflows to identify hidden footholds.

The geographic and sectoral footprint of the campaign is exceptionally broad. According to Microsoft’s tracking data, Storm-0940 has utilized Artex in automated attacks against hundreds of organizations spanning a vast spectrum of industries since early September. Targeted sectors include aerospace, automotive, chemicals, defense, energy, financial services, government entities, legal firms, manufacturing, media, military organizations, semiconductor manufacturing, software development, and technology providers, alongside critical non-profit organizations and policy think tanks.

Further technical insights into the mechanics of the campaign emerged as Zscaler published an exhaustive technical deep-dive analyzing Storm-0940’s AI-assisted hacking operations. Zscaler’s report provides granular details regarding how the threat actor configures and deploys the Artex framework, including analyses of synchronization scripts, a recovered Claude Code prompt history, and advanced network routing tools utilized during the incursions.