China-Linked Storm-0940 Uses ARTEX AI Agents in ConnectWise Supply Chain Attack

Supply Chain Compromise

Microsoft disclosed that the China-aligned threat actor Storm-0940 compromised the ConnectWise Cloud Backup application in a supply chain attack. The group has been active since at least 2021 and was first detailed by Microsoft in November 2024. Storm-0940 uses a botnet known as Quad7 to conduct highly evasive password spray attacks and exploits internet-facing applications for initial access.

ARTEX AI Agent Usage

The attackers employed ARTEX, a Go-based agentic AI penetration testing framework that was closed-source after its abuse against South Korean financial institutions. ARTEX enabled the group to automate scanning, reconnaissance, password spraying and OAuth application abuse at machine speed across hundreds of organizations worldwide since September 2026. In the ConnectWise incident the AI agents attempted sign-in to more than 2,250 tenants at a rate of 2,900 attempts per minute. Between October 10-14 2026 the infrastructure at 144.172.64.99 launched a cross-tenant password-spray campaign targeting 327 accounts across eight organizations, generating over 151,000 failed logon events with a peak of 2,900 failures per minute on October 11. No successful authentication was observed during that window. On October 15 2026 the agents gained control of multiple ConnectWise cloud application identities and used them to authenticate to customer environments; in some cases they are assessed to have progressed to Microsoft Graph and directory operations such as reconnaissance, credential modifications and privileged role changes.

Impact and Response

ARTEX-driven attacks have resulted in privileged cloud access in several cases, with the time from initial targeting to privileged access measured at less than three hours. Microsoft warned that credential modifications made by the agents can persist as backdoors even after the original compromised application is remediated. The framework has also been adopted by threat actors in multiple geographic regions. ConnectWise stated that the campaign extends beyond any single company and that nation-state actors are increasingly targeting the software supply chain. The company temporarily shut down services and is restoring them in phases, a process it said will take several days.

Earlier coverage: ConnectWise Suspends Cloud Backup After Attackers Compromise Microsoft 365 Tenants

Sources: The Hacker News