AI agents got China-linked hackers into company clouds in under three hours, Microsoft says

Microsoft Threat Intelligence reported on Wednesday that the China state-aligned group Storm-0940 used an AI agent framework called ARTEX to compromise ConnectWise Cloud Backup and reach more than 2,250 customer tenants at 2,900 sign-in attempts per minute, with some intrusions moving from target selection to privileged cloud access in under three hours. Between October 10 and 14, one Storm-0940 server logged more than 151,000 failed sign-ins against 327 accounts at eight organizations, and the group then used stolen ConnectWise app credentials to sign in to customer tenants that had already trusted those apps, with no user sign-in involved. Microsoft described ARTEX as a Go-based multi-agent system with a Next.js front end that can run a penetration test "from reconnaissance through data exfiltration with little needed human interaction," and said that "while the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.

ConnectWise’s logo. Image: ConnectWise https://commons.wikimedia.org/wiki/File:Connectwise-Logo.png / Wikimedia Commons, CC BY-SA 4.0 https://creativecommons.org/licenses/by-sa/4.0/ , cropped A Chinese state-aligned hacking group used an AI agent system to go after hundreds of organisations around the world, and turned a trusted backup app into a way into its customers’ Microsoft 365 accounts, Microsoft Threat Intelligence said on Wednesday https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ . In several attacks, Microsoft says, the group went from first picking a target to privileged access in its cloud in less than three hours. Microsoft calls the group Storm-0940 and the tool ARTEX, the AI hacking framework already tied to data thefts at four South Korean banks https://madrobot.blog/2026/10/02/south-korea-banks-shinhan-kb-kookmin-hana-hacked-ai-tool-artex-suspected/ and, this week, attacks on dozens of Japanese firms https://madrobot.blog/2026/10/21/artex-chinese-ai-hacking-tool-japan-cyberattacks-gmo-korea-banks/ . It assesses that Storm-0940 was behind last week’s compromise of ConnectWise Cloud Backup formerly SkyKick , a service IT providers use to back up their clients’ Microsoft 365 and Google Workspace data. What the AI did Storm-0940 has been active since 2021 and is after data, Microsoft says. Its usual moves are password spraying trying common passwords across many accounts and planting credentials in apps that already have standing access to a company’s data. Since at least September, ARTEX has automated that work. In the ConnectWise campaign, Microsoft says, ARTEX sped up scanning and reconnaissance, password spraying and the abuse of OAuth apps at ConnectWise’s customers. Between October 10 and 14, one Storm-0940 server racked up more than 151,000 failed sign-ins against 327 accounts at eight organisations, without a single success. ConnectWise was the way in. Once the group controlled the identities of several ConnectWise cloud apps, “the AI agents operating on behalf of the threat actor” used the stolen app credentials to sign in to customer tenants that had already trusted those apps, with no user sign-in involved. Microsoft says ARTEX reached more than 2,250 tenants at 2,900 sign-in attempts a minute. In some, the agents went on to map directories, plant back-door credentials and change privileged roles. One of Microsoft’s detection alerts describes a ConnectWise management app granting itself the Global Administrator role. What ARTEX is Microsoft describes ARTEX as a multi-agent system, written in Go with a Next.js front end, that can use any AI model and run a penetration test “from reconnaissance through data exfiltration with little needed human interaction”. Microsoft doesn’t say which model Storm-0940 ran. The tool first surfaced in the Korean bank hacks, where CrowdStrike later found an attacker’s ARTEX setup next to Claude Code session files. Its developer took it closed-source on October 8, saying attacks went against its purpose, but copies of the public code may still be out there. It is the latest sign that AI agents are now doing hands-on hacking: one attacker recently set agents loose on 1,200 websites https://madrobot.blog/2026/10/19/hacker-ai-agents-cairn-1200-websites-deere-sharkninja-norforge/ . Speed is the point: agents work around the clock and try several routes at once, so defenders get little time to act on the alerts they set off. “While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time,” its researchers write. Who was targeted Microsoft lists aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits. It describes the targets as global but doesn’t name countries or victims. It stresses that no flaw in its own systems was involved, and that a successful attacker sign-in doesn’t necessarily mean data was taken. What ConnectWise and admins should do ConnectWise said in a security advisory https://www.connectwise.com/company/trust/advisories that it had “identified unauthorized access to application identities within the ConnectWise Cloud Backup environment” and shut off Cloud Backup, SaaS Security and Cloud Management. It says it has “no indicators to date” that partners’ backup data was compromised, has reset accounts and credentials, and is preparing to restore the services in phases, with no date yet. Its advisory doesn’t name an attacker. Microsoft’s advice for anyone who used the apps: - Keep them off: leave affected ConnectWise connections disabled until ConnectWise issues restoration instructions. - Don’t delete first: preserve the enterprise apps’ configuration and sign-in and audit logs before removing anything. - Look back: search every tenant by application ID, not display name, and review app sign-ins from at least October 15, ideally October 1. - Hunt for back doors: check for new app credentials, consent grants, role assignments, mailbox forwarding and inbox rules, plus sign-ins from 144.172.64 . 128, 144.172.64 . 99 and 144.172.64 . 60. Why it matters ARTEX has moved from suspected use by unknown attackers to a named state-aligned group, aimed at a supplier that sits inside thousands of companies at once. Rotating one stolen credential is no longer enough when an AI agent can plant new ones across hundreds of tenants faster than a security team can read the alerts. Coming the same day as the LiteLLM hijack https://madrobot.blog/2026/10/21/litellm-1-107-0-pypi-compromised-credential-stealer-ai-api-keys/ , it shows how much damage one trusted tool in the supply chain can do. Sources: Microsoft Threat Intelligence October 21, 2026 https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ ; ConnectWise Trust Center advisories https://www.connectwise.com/company/trust/advisories .