GoKawiilMicrosoft says China-linked Storm-0940 used AI agent ARTEX in ConnectWise credential attack
Microsoft's Security blog reports that Storm-0940, a China-state-aligned hacking group, used an open-source AI agentic penetration-testing tool called ARTEX to exploit stolen ConnectWise application credentials, attempting sign-ins across more than 2,250 Microsoft 365 tenants. The group also ran automated password-spraying attacks against 327 accounts at eight organizations, generating over 151,000 failed login attempts without success. Microsoft says the breach did not stem from any vulnerability in its own systems and that it remains unclear how the ConnectWise credentials were obtained or how many tenants were actually compromised.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests that autonomous AI agents can dramatically compress attack timelines, with Microsoft noting some intrusions reached privileged access within three hours, potentially outpacing traditional detection and response efforts. It points to a broader risk in supply-chain software, where compromising a single vendor's credentials can expose thousands of downstream customer tenants at once. The targeting of aerospace, defense, semiconductor and government sectors indicates the campaign may align with state-level intelligence-gathering interests, according to Microsoft's attribution.
- Storm-0940 used the AI-driven ARTEX framework to automate reconnaissance, password spraying and OAuth credential abuse in a ConnectWise-linked attack.
- Attackers attempted sign-ins across 2,250+ Microsoft 365 tenants and ran password sprays generating 151,000+ failed logons with no reported successes.
- Microsoft says its own systems weren't compromised, but it's unclear how ConnectWise credentials were stolen or how many tenants were actually breached.
YubiKey 5C NFC Security Key — With attackers using AI agents to automate credential theft and OAuth abuse at scale, hardware-based multi-factor authentication like a YubiKey makes stolen passwords far less useful to intruders. It's a simple, durable way to add phishing-resistant login protection to Microsoft 365 and other critical accounts targeted in attacks like this.
See YubiKey 5C NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: tomshardware.com — Shane Downing, 2026-10-23
Published there as: “China-aligned hackers deploy AI agents in massive ConnectWise supply chain attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.