Microsoft says a China-state aligned group used an AI-driven penetration testing framework to target hundreds of organizations worldwide. The company assesses that the group, which it tracks as Storm-0940, was responsible for the recently disclosed ConnectWise supply chain compromise.
The group began using the open-source ARTEX framework as early as September 2026, according to Microsoft. ARTEX can automate steps from reconnaissance through attempts to extract data. Microsoft says several attacks gave Storm-0940 privileged access to cloud systems. In multiple cases, that took less than three hours from initial targeting.
The attackers used trusted app access
Microsoft says ConnectWise reported unauthorized access to customer tenants on October 16 through multiple OAuth application identities. After gaining control of identities belonging to ConnectWise cloud applications, Storm-0940 used ARTEX to authenticate to customer environments through access those applications already had. That did not require an interactive user sign-in.
According to Microsoft, the group reached more than 2,250 tenants at a rate of 2,900 sign-in attempts per minute. In multiple customer environments, Microsoft observed subsequent activity through Microsoft Graph, including reconnaissance, changes to application credentials and attempts to modify privileges. Microsoft says some credential changes could allow access to persist after the original affected application is addressed.
Microsoft distinguishes access from data theft
Microsoft also recorded a password-spraying campaign against 327 accounts at eight organizations between October 10 and 14. It captured more than 151,000 failed logons, but observed no successful authentication in that campaign. Microsoft says the presence of an affected application, or even a successful authentication, does not by itself show that customer data was accessed or taken.
Microsoft says this activity did not stem from a compromise of or vulnerability in its own systems, products or services. It advises customers to review service principal sign-ins and unexpected application credential or privilege changes. Defender XDR customers can use its detections and hunting queries, and affected organizations should follow ConnectWise’s published containment guidance.
