The Storm-0940 and ConnectWise case represents a milestone in cybersecurity history: for the first time, a documented state-sponsored espionage group has used autonomous AI agents to automate a supply chain attack at industrial scale, compressing the time from target selection to privileged access to less than three hours.
Microsoft disclosed on October 21, 2026, the details of a massive campaign conducted by the Storm-0940 actor, a China-aligned espionage group active since at least 2021. The group exploited compromised application credentials from ConnectWise Cloud Backup — an IT management tool widely used by managed service providers (MSPs) — to attempt access to more than 2,250 Microsoft 365 tenants, reaching peaks of 2,900 login attempts per minute.
What makes this incident remarkable is not the technique itself, but the accelerator: Storm-0940 deployed ARTEX, an open-source agentic AI-based penetration testing framework written in Go, to automate everything from reconnaissance to OAuth abuse at machine speed. AI agents are not subject to the same human constraints — they can operate 24 hours a day, seven days a week, test multiple attack vectors simultaneously, and adjust strategies in real time based on target system responses.
Between October 10 and 14, 2026, Storm-0940 infrastructure at IP 144.172.64.99 conducted an automated password-spray campaign against 327 accounts across eight organizations, generating over 151,000 failed login attempts. Microsoft captured 111,000 failures in a single day. Although no successful logins were recorded in this initial phase, on October 15 the group shifted tactics: it began using compromised ConnectWise Cloud Backup application identities to authenticate to customer tenants as the application itself, without requiring interactive user login.
This is crucial because OAuth application credentials are authenticated as the application, not as a user — meaning MFA (multi-factor authentication) is not triggered. An attacker who obtains a connected service's secret can access the entire tenant, bypassing all user-based identity protection. In one case analyzed by Huntress, the ConnectWise Cloud Management application granted itself the Global Admin role and planted new secrets on other applications within the tenant.
ARTEX, the engine behind the attack, is a multi-agent system originally designed for legitimate penetration testing. But Microsoft observed that Storm-0940 configured it to use a DeepSeek model through an OpenAI-compatible gateway, and that other configurations also specified GLM and Grok models. The framework was made closed-source after being used in attacks against South Korean financial institutions in September 2026.
According to Microsoft, the ARTEX agents not only authenticated to the tenants — they progressed to Microsoft Graph and directory operations, including reconnaissance, application credential modifications to establish persistence, and changes involving identities, groups, and privileged roles. "The application credential modifications made by Storm-0940's associated agents in the targeted victims' environments can lead to persistence through other identities, credentials, and cloud services," Microsoft warned. "These changes can remain active as a backdoor even after the original compromised application is mediated."
The scope of the attack extends far beyond ConnectWise customers. Expel documented activity from the same infrastructure (144.172.64.99) exploiting Okta's self-service registration system in a customer tenant, creating its own accounts, completing 50 successful SSO sign-ins to production and staging apps, and attempting user enumeration with 150 failed token requests across 10+ client IDs.
ConnectWise suspended its Cloud Backup, SaaS Security, and Cloud Management services on October 16. The company disabled seven application identities on October 17 and says the compromised secret is no longer valid, though previously issued access tokens may remain usable until they expire. ConnectWise has been holding tutorial sessions and webinars every two hours, around the clock, to help partners identify indicators of compromise in Microsoft 365 tenants.
This incident reveals a structural shift in the nature of state-sponsored threats. Groups like Storm-0940 had already been using traditional techniques such as password spraying and application abuse for years. What changes now is the speed and scale at which they can execute these tactics. Autonomous agents do not get tired, do not take vacations, and do not have cognitive limits — they can test thousands of attack vectors simultaneously, learn from each failure, and adjust strategy in seconds.
The implication is straightforward: traditional defense against high-speed threats is unbalanced. When an AI agent can test 2,900 login attempts per minute against globally distributed tenants, detection systems must operate at the same pace. And that means defense-side AI becomes indispensable — otherwise, defenders will always be one step behind.
The question that remains is whether offensive AI frameworks like ARTEX will continue to be found in open source, or whether pressure on their maintainers to make them proprietary will only intensify — and what that means for the global attack surface when every state-sponsored and criminal actor has access to customized, untraceable versions.
Sources: Microsoft Security Blog, The Register, The Hacker News
✓ Independent sources cross-checked and verified before publishing
