Microsoft says a China-aligned group tracked as Storm-0940 used AI agents and stolen ConnectWise application credentials to go after more than 2,250 Microsoft 365 tenants. The attackers relied on ARTEX, an open source penetration-testing tool that uses AI agents to automate their work. In some cases, they moved from choosing a target to holding privileged cloud access in under three hours.
The findings explain more about the ConnectWise incident. The IT management vendor shut down its Cloud Backup, SaaS Security and Cloud Management services after it found unauthorized access to application identities. At first, ConnectWise did not name a culprit, but Microsoft has now pointed to Storm-0940, an espionage group active since at least 2021.
ARTEX, written in Go, automates reconnaissance, vulnerability discovery, credential attacks and data theft. Microsoft says Storm-0940 began using it as early as September against organizations worldwide, including government agencies, defense contractors, banks, manufacturers and tech firms.
The campaign started with brute force. Between October 10 and 14, the attackers made more than 151,000 failed sign-in attempts against 327 accounts at eight organizations, and Microsoft saw no successful logins. They then switched tactics and used the compromised ConnectWise application identities. Those credentials let them exploit permissions that customers had already granted, so no interactive login was needed. Armed with ARTEX, they tried to authenticate against more than 2,250 tenants, sometimes reaching 2,900 attempts a minute.
Microsoft also saw AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to alter privileges. Those steps could let attackers stay put even after defenders revoke the original credentials. Most attempts failed, yet Microsoft says the group still gained persistent privileged access at numerous organizations. It has not said how many customers it compromised or whether anyone stole data, and it cautions that a successful login does not prove access to information.
ConnectWise chief executive Manny Rivelo said the company contained the affected connections and is restoring services gradually. Even so, cutting those connections would not necessarily remove attackers who had already established a foothold. ConnectWise also disclosed a nation-state breach in May 2025, though nothing suggests the two incidents are linked. Other attackers across several regions have also used ARTEX.
The techniques themselves are familiar: stolen credentials, password spraying and application abuse. What changed is speed, since AI helped the attackers move faster through each step.
