A sophisticated cyber espionage group, identified as Storm-0940, has been targeting organizations worldwide using the AI-enabled penetration testing tool Artex. This group, linked to China, has been active since at least 2021 and is known for its reliance on techniques like password spraying and exploiting vulnerabilities in internet-facing applications to infiltrate various sectors. Recently, Microsoft reported that Storm-0940 leveraged Artex in a campaign against ConnectWise, affecting hundreds of organizations across multiple industries including aerospace, defense, and financial services.

The attacks began in early September 2026, with the threat actor automating its intrusions using Artex. This resulted in the compromise of ConnectWise application credentials, giving the attackers unauthorized access to hundreds of Microsoft 365 tenants. Notably, more than 300 Entra tenants were affected, with over 2,900 login attempts per minute recorded. Despite the high number of failed login attempts, there were successful authentications into customer environments, allowing the attackers to perform reconnaissance and modify application credentials for persistent access.

In response to the security breach, ConnectWise suspended several services, including Cloud Backup and SaaS Security. Microsoft emphasized the need for organizations to closely monitor service principal sign-ins and subsequent Microsoft Graph activity, as such vigilance could help detect and mitigate unauthorized access. The threat actor's use of Artex significantly accelerated the pace of the attacks, demonstrating the increasing role of AI in cyber threats.

Zscaler recently published an in-depth analysis of Storm-0940's tactics, shedding light on the configurations and tools used in these AI-assisted attacks. As the cybersecurity landscape evolves, organizations must remain vigilant against these advanced persistent threats to protect their sensitive data and systems.