A sophisticated cyberattack orchestrated by a Chinese nation-state actor has targeted Microsoft 365 tenants associated with ConnectWise, resulting in several of the IT management software provider’s cloud services being taken offline. Microsoft's investigation revealed that the threat actor, identified as Storm-0940, utilized the ARTEX AI penetration testing framework to compromise a wide range of organizations worldwide. This campaign, which began in September 2026, affected sectors such as aerospace, defense, energy, and financial services.
The group managed to gain privileged access to cloud infrastructures, including ConnectWise, often within a mere three hours after initial targeting. Their strategy involved password spraying and exploiting internet-facing applications to gain initial access, followed by establishing persistence through application credential modifications. After infiltrating the ConnectWise multi-tenant application, Storm-0940 used the ARTEX platform to efficiently conduct scanning and reconnaissance operations, further exploiting OAuth applications to maintain their foothold.
Microsoft reported that the group attempted sign-ins at a staggering rate of 2900 attempts per minute, affecting over 2250 tenants. This rapid pace left defenders with minimal time to detect and respond to the breach. Evidence of subsequent malicious activity was found in several customer environments, including unauthorized changes to application credentials and identity management.
ConnectWise detected suspicious activity in its network on October 15 and confirmed unauthorized access to application identities by October 17, prompting them to take several cloud services offline. As a response, ConnectWise began a phased restoration of its Cloud Backup service on October 22, assuring customers that backup archives remained secure and uncompromised. The company also advised customers to inspect their Microsoft 365 tenants for any unauthorized modifications.
ARTEX, the AI framework used in this attack, is capable of automating offensive security workflows, including penetration tests, and can operate in multiple languages such as Mandarin and Korean. This incident underscores the growing threat posed by state-sponsored actors leveraging AI to exploit software supply chains.
