> ## Content Index
> Fetch the complete content index at: https://bullquill.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Storm-0940 used ARTEX AI pentesting tool against 2,250+ tenants
- URL: https://bullquill.com/storm-0940-artex-ai-agents-connectwise-attack/
- Published: 2026-10-24T06:14:35.000Z
- Updated: 2026-10-24T06:25:33.000Z
- Description: Stolen ConnectWise app credentials let the attackers skip passwords and MFA, reaching privileged access in under three hours in some tenants, Microsoft says. Here is what ARTEX is and what defenders should check.
- Author: Rowan Ashby
- Tags: AI, Trending, Microsoft, Storm-0940, ARTEX, ConnectWise, AI Agents, #lang-en, #tr-storm-0940-artex-ai-agents-connectwise-attack

## Key takeaways

- Microsoft attributes the ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a group it assesses as China-state aligned, and says the group ran the campaign with ARTEX, an open-source agentic AI pentesting framework.
- According to Microsoft, ARTEX-driven activity reached sign-in attempts against more than 2,250 Microsoft 365 tenants, peaked at 2,900 failed sign-ins per minute, and in several cases went from targeting to privileged access in under three hours.
- The core weakness was not user passwords: stolen credentials for ConnectWise multi-tenant applications let the attackers authenticate to customer tenants without any interactive sign-in or MFA prompt.
- Microsoft does not name the AI model behind the Storm-0940 activity. Reports linking ARTEX to Claude Code come from a separate CrowdStrike investigation into attacks on South Korean banks, not from the ConnectWise case.
- Defenders using ConnectWise Cloud Backup, SaaS Security or Cloud Management should keep those connections disabled, preserve evidence, and review Entra ID audit logs back to at least October 1.

## What Microsoft says ARTEX did in the ConnectWise attack

In an October 21, 2026 report, Microsoft said China-aligned Storm-0940 used the **ARTEX AI pentesting tool** in the ConnectWise Cloud Backup breach, targeting more than 2,250 Microsoft 365 tenants and peaking at 2,900 failed sign-ins per minute.

Microsoft tracks Storm-0940 as a China-state aligned actor that has been active since 2021 and has no known industry aliases. The company says the group has historically relied on password spraying, exploiting internet-facing applications, and adding credentials to existing OAuth applications. ARTEX, in Microsoft's account, let the group run those familiar techniques far faster and at much larger scale than a human team could.

Microsoft also stressed that "the majority of the targeting wasn't successful". Still, it reported that the group reached privileged cloud persistence in a number of organizations.

## What is ARTEX?

ARTEX is an open-source penetration testing framework built around multiple cooperating AI agents. Microsoft describes it as a multi-agent LLM system written in Go with a Next.js web interface, and says it can be connected to "any AI model". Its interface defaults to English and can be switched to Korean, Mandarin, Spanish or Japanese.

The agents can run a full test chain with little human involvement: mapping a target, probing for weaknesses, exploiting them and, if configured, exfiltrating data. Discovered assets and vulnerabilities are stored in a graph that later agents use to decide their next step. The Cloud Security Alliance, summarising public research, describes a planner agent that splits a target into tasks and worker agents that run real tools such as shell commands, HTTP requests and port scans, sharing logs so one agent's findings steer the next.

Cybersecurity Dive reports that ARTEX was developed in China. According to the Cloud Security Alliance, its developer, who uses the GitHub handle "Autumn-27", took the project closed-source after earlier misuse became public, saying it had been built for learning and research. Forks of the open version reportedly remain in circulation, so the code has not disappeared.

## How the attack unfolded: timeline

| Date (2026)             | Event                                                                                                                           | Source                     |
| ----------------------- | ------------------------------------------------------------------------------------------------------------------------------- | -------------------------- |
| Early September         | ARTEX-driven activity by Storm-0940 begins                                                                                      | Microsoft                  |
| Oct 10–14               | Password spray from one IP address targets 327 accounts across eight organizations; no successful sign-in observed in that wave | Microsoft                  |
| Oct 11                  | Spray peaks at 2,900 failed sign-ins per minute                                                                                 | Microsoft                  |
| Oct 15, 06:13–08:34 UTC | Cloud Backup application authenticates from a hosting-provider IP instead of its usual Azure address space                      | CSO Online (Huntress data) |
| Oct 16                  | ConnectWise publishes its first advisory; Huntress has flagged suspicious sign-ins at 162 organizations                         | Microsoft, CSO Online      |
| Oct 17                  | ConnectWise disables seven application identities                                                                               | CSO Online                 |
| Oct 19                  | ConnectWise adds two more attacker IPs and reports no successful activity since containment                                     | CSO Online                 |
| Oct 21                  | Microsoft attributes the campaign to Storm-0940 and ARTEX                                                                       | Microsoft                  |

## The numbers behind the ARTEX campaign

| Metric                                      | Figure                                                  | Source                        |
| ------------------------------------------- | ------------------------------------------------------- | ----------------------------- |
| Microsoft 365 tenants with sign-in attempts | More than 2,250                                         | Microsoft; Cybersecurity Dive |
| Peak spray rate                             | 2,900 failed sign-ins per minute (Oct 11)               | Microsoft                     |
| Failed logon events                         | More than 151,000 (over 111,000 in one day)             | Microsoft                     |
| Accounts with more than 1,000 failures      | 48                                                      | Microsoft                     |
| Fastest time to privileged access           | Under 3 hours (multiple cases)                          | Microsoft                     |
| App-only sign-ins in one burst              | 200+ in under 4 minutes using 4 application credentials | Microsoft                     |
| ConnectWise application identities disabled | 7                                                       | CSO Online                    |

## Why OAuth app abuse made the attack so fast

The decisive step was the theft of credentials belonging to ConnectWise's own multi-tenant applications. Cloud Backup, formerly sold as SkyKick, is used through managed service providers to back up Microsoft 365 and Google Workspace data, so it holds broad permissions across Exchange Online, OneDrive, SharePoint and Teams.

CSO Online, citing Huntress research, reports that the stolen credential sat in ConnectWise's own tenant and was used to obtain Microsoft Graph tokens inside customer tenants. Because this was application authentication, no user password was needed and no MFA prompt appeared. Once inside, Microsoft observed Graph reconnaissance, changes to application credentials, privilege modifications and bulk reads of Key Vault secrets. In at least one tenant, a ConnectWise management application assigned itself the Global Administrator role; Huntress put that sequence at about five minutes.

Jon Semon, a principal security operations analyst at Huntress, told Cybersecurity Dive: "Our working hypothesis is that these attacks were conducted by an AI agent leveraging scripted tooling." Microsoft's indicators support that pattern, listing scripted user agents such as python-requests and curl.

## Is Claude Code linked to Storm-0940?

Not on the evidence published so far. Microsoft's report refers only to "any AI model" and LLM-driven agents and does not name a model or vendor. The Claude Code connection comes from a different case: CrowdStrike's October 7 report on a campaign against South Korean financial firms, in which, according to the Cloud Security Alliance's summary, open directories on attacker servers exposed ARTEX configuration files alongside Claude Code session histories. CrowdStrike assessed that operator as Chinese-speaking and financially motivated, and did not tie it to Storm-0940\. Until a primary source links the two, the Claude Code detail should be treated as unconfirmed for the ConnectWise attack.

## What ConnectWise has said

ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management, which means scheduled backups, archive restores and SaaS Security alerting are unavailable while services return in phases. In its advisory, the company said: "Existing backup archives remain encrypted and isolated, and we have no indication that those archives have been compromised." Chief executive Manny Rivelo told Cybersecurity Dive that nation-state actors "are increasingly targeting the software supply chain".

Huntress has not confirmed data theft. It noted, however, that some Graph directory reads leave no audit trail, so the absence of recorded mail or file access does not prove nothing was taken.

## What defenders should check now

1. **Keep ConnectWise connections disabled** until ConnectWise issues formal restoration instructions.
2. **Preserve evidence first.** Microsoft advises: "Do not delete enterprise applications as the first response."
3. **Search by application ID, not display name.** Microsoft lists the Cloud Backup app ID 506e08f9-6e9a-4da4-942b-a099a03644ae among the IDs to inventory.
4. **Review service-principal sign-ins back to October 1** and all tenant activity from October 15, including sign-ins from 144.172.64.99, 144.172.64.128 and 144.172.64.60.
5. **Audit Entra ID** for new credentials, new owners, role assignments and consent grants; rotate credentials where activity is confirmed.
6. **Check Microsoft 365 audit logs** for mailbox forwarding rules, delegated permissions and unusual mail or file access.
7. **Apply least privilege** to every third-party multi-tenant app, and alert on credential additions and privilege changes made by applications.

For background on how identity platforms are adapting to autonomous software, see our report on [1Password's plan to let AI agents log in without passwords](https://bullquill.com/1password-ai-agents-login-without-passwords/) and why [US banks are blocking AI agents from customer accounts](https://bullquill.com/us-banks-block-ai-agents-customer-accounts/).

## What it means

The ConnectWise case shows that agentic AI does not need new exploits to cause damage. Storm-0940's techniques were old ones; ARTEX made them cheap, fast and relentless, compressing work that once took days into hours. For defenders, that shifts the emphasis from blocking single logins to watching what applications do after they authenticate, because a trusted vendor app with broad Graph permissions can be turned against every customer at once.

It also adds to a growing debate about dual-use AI security tools. Testing frameworks published for research can be repurposed within weeks, and closing a repository does not recall copies already forked. Recent work on AI agents in offensive testing, such as [the UK AISI incident involving Claude Mythos 5](https://bullquill.com/claude-mythos-5-aisi-incident-analysis/) and concerns over [OpenAI agents weakening internal monitoring](https://bullquill.com/openai-agents-weakened-internal-monitoring/), points the same way: oversight of autonomous agents is now a security issue, not only a research one.

Key unknowns remain: how many tenants suffered successful intrusions, whether any customer data was exfiltrated, and which AI models Storm-0940 actually ran inside ARTEX.

## Frequently asked questions

### What is the ARTEX AI pentesting tool?

ARTEX is an open-source penetration testing framework in which multiple AI agents cooperate to map a target, find weaknesses, exploit them and, if configured, exfiltrate data. Microsoft describes it as a multi-agent LLM system written in Go with a Next.js interface that can be connected to any AI model.

### What happened in the ConnectWise Cloud Backup attack?

Attackers obtained credentials for ConnectWise multi-tenant applications and used them to authenticate to customer Microsoft 365 tenants without a user sign-in or MFA. Microsoft attributes the campaign to Storm-0940 and says sign-in attempts reached more than 2,250 tenants; ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management.

### Who is Storm-0940?

Storm-0940 is Microsoft's name for a threat actor it assesses as China-state aligned, active since 2021, with no known industry aliases. It has historically used password spraying, exploitation of internet-facing applications and abuse of OAuth application credentials.

### Was Claude Code used in the Storm-0940 attack?

That has not been confirmed. Microsoft's report does not name any AI model. The Claude Code link comes from a separate CrowdStrike investigation into ARTEX use against South Korean banks, which was not attributed to Storm-0940.

## Sources

- [Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (Oct 21, 2026)](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/?ref=bullquill.com)
- [Cybersecurity Dive: China-nexus actor linked to attack on ConnectWise Cloud Backup (Oct 22, 2026)](https://www.cybersecuritydive.com/news/china-nexus-actor-attack-connectwise-cloud-backup/833727/?ref=bullquill.com)
- [CSO Online: ConnectWise backup credentials exposed multiple Microsoft 365 tenants (Oct 19, 2026)](https://www.csoonline.com/article/4237087/connectwise-backup-credentials-exposed-multiple-microsoft-365-tenants.html?ref=bullquill.com)
- [Tom's Hardware: Microsoft says China-aligned hackers used AI agents in ConnectWise supply chain attack](https://www.tomshardware.com/tech-industry/cyber-security/microsoft-says-china-aligned-hackers-used-ai-agents-in-connectwise-supply-chain-attack-agents-attempted-sign-ins-at-more-than-2-250-microsoft-365-tenants-with-some-of-the-groups-attacks-reaching-privileged-access-in-under-three-hours?ref=bullquill.com)
- [Cloud Security Alliance: ARTEX, open-source agentic pentest tool turned on Korean banks](https://labs.cloudsecurityalliance.org/research/csa-research-note-artex-agentic-pentest-tool-korean-banks-20/?ref=bullquill.com)