Microsoft: Storm-0940 used agentic AI tool ARTEX on 2,250+ tenants

Microsoft Threat Intelligence said on 21 October 2026 that Storm-0940, a China-state aligned actor, used an open-source agentic AI penetration-testing framework called ARTEX to automate attacks on hundreds of organisations worldwide, starting as early as September 2026. Microsoft assesses that the same group was behind the recently disclosed ConnectWise supply-chain compromise of a multi-tenant cloud backup application.

What Microsoft reports

ARTEX, in Microsoft's description, is a multi-agent LLM system written in Go with a Next.js front end that can use any AI model. Its agents run a penetration test from reconnaissance to data exfiltration with little human input, and collect the assets and vulnerabilities they find into a graph. Microsoft says it has seen threat actors in several regions using it, and that public reporting in October 2026 linked it to personal-data breaches at Korean financial institutions.

• Reach: Microsoft says Storm-0940 targeted hundreds of organisations across sectors including aerospace and defence, energy, financial services, government, legal, software and semiconductors. After the unauthorised access at ConnectWise, the actor used ARTEX to attempt sign-ins to more than 2,250 tenants.
• Speed: Several ARTEX-driven attacks gave the actor privileged access to an organisation's cloud infrastructure, and Microsoft says multiple took under 3 hours from initial targeting. It says most of the targeting was not successful, but the actor still achieved privileged cloud persistence at many organisations in a short time.
• Password spraying: Between 10 and 14 October, infrastructure at 144.172.64.99 sprayed 327 accounts at eight organisations, with more than 151,000 failed logons, a peak of 2,900 failures a minute on 11 October, and lockouts making up nearly 98% of the activity. Microsoft saw no successful authentication, token, Graph call or directory change from it.
• Link to ConnectWise: Microsoft says ConnectWise's 16 October advisory listed an IP address matching exactly that spray infrastructure. After taking control of ConnectWise cloud application identities, the agents used the apps' existing trust to sign in to customer tenants and, in some, went on to Microsoft Graph reconnaissance, application credential changes and privilege and group changes.

Microsoft stresses two limits. The activity was not caused by a vulnerability in Microsoft's own systems, products or services, and an affected application or a successful sign-in does not necessarily mean customer data was accessed or taken.

Why it matters for AI rollouts

Microsoft's argument is about tempo: agents can work around the clock and try several breach paths at once, which leaves defenders little time between an alert and containment. Microsoft says the reach came from a third-party app that customers had already trusted with high privileges. Many AI assistants and agent connectors are added to a tenant on the same terms, which is my observation, not Microsoft's.

What to do

• Inventory the four application IDs in Microsoft's post in every tenant where the ConnectWise apps are or were installed, searching by application ID rather than display name, and keep the connections disabled until ConnectWise provides formal restoration instructions.
• Preserve Entra sign-in and audit records, Purview audit records and SIEM data before changing anything, and do not delete the enterprise applications as a first response.
• Review service-principal sign-ins from at least 15 October 2026 (and from 1 October where records exist), plus credential additions, app-role assignments, consent grants and privileged role changes. Microsoft notes that credentials added to other identities can stay active as a backdoor after the original app is fixed.
• Apply least privilege to multi-tenant application permissions and consent grants, and alert on credential additions and anomalous app-only activity from highly privileged apps.

What the source leaves out

This is Microsoft describing an actor it tracks, and it publishes no count of tenants that were actually compromised or how much data left them. The attribution of the ConnectWise compromise is Microsoft's assessment. The post also promotes Microsoft's own Defender detections and a Security Dashboard for AI, which are one option, not the only way to do this review.