# Chinese State Hackers Used AI Agent ‘ARTEX’ To Breach Over 2,250 Microsoft 365 Tenants In Hours, Microsoft Says > Source: > Published: 2026-10-22 11:06:23+00:00 Amidst the [PHP vulnerability](https://officechai.com/stories/php-rushes-out-emergency-patch-for-two-critical-flaws-after-vulnerability-details-leak-online/) and the [eMudhra keys fiasco](https://officechai.com/stories/indias-emudhra-certificate-hack-explained/), there are many other cyberescurity incidents brewing. Microsoft has disclosed that a China-linked hacking group used an autonomous AI penetration-testing framework called ARTEX to pull off one of the largest and fastest AI-driven supply chain attacks seen to date, compromising the backup software vendor ConnectWise and using it as a springboard into thousands of downstream customer environments. In a security blog post, Microsoft said the threat actor, which it tracks as Storm-0940, began using ARTEX as early as September 2026 to automate attacks against hundreds of organizations across industries including aerospace, defense, energy, financial services, government, and semiconductors. Microsoft assesses with confidence that Storm-0940 was behind the recently disclosed ConnectWise supply chain compromise, in which a popular cloud backup application was used to gain privileged access to customer tenants. What stands out most is the speed. Microsoft said several of the ARTEX-driven attacks resulted in the actor obtaining privileged access to an organization’s cloud infrastructure in under three hours from initial targeting — a pace that would be essentially impossible for a human-run operation. During the ConnectWise incident specifically, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at a rate of roughly 2,900 attempts per minute, generating over 151,000 failed logon events in a single campaign window between October 10 and 14. ## How The Attack Unfolded Storm-0940 is a China-state aligned group that has been active since 2021, historically relying on password spraying and exploitation of internet-facing applications to gain initial access. According to Microsoft, the group’s infrastructure conducted a cross-tenant password-spray campaign targeting hundreds of accounts across multiple organizations, with activity peaking at nearly 3,000 failures per minute. Despite the scale, Microsoft noted that this particular spray campaign alone did not result in any successful authentication. Shortly after, public reports of a compromise at ConnectWise’s cloud backup product began to surface, with indicators of compromise tracing back to the same infrastructure used in the password-spray campaign. Once the group had control of credentials for ConnectWise’s cloud applications, its AI agents used the already-established trust those applications had within customer tenants to authenticate directly to Microsoft 365 environments — without needing an interactive user sign-in at all. From there, Microsoft observed the AI agents moving well beyond simple access: conducting reconnaissance through Microsoft Graph, modifying application credentials to establish persistence, and in some cases attempting to escalate privileges, including one instance where a compromised application assigned itself a Global Administrator role. Microsoft was careful to note that the presence of an affected application, or even a successful sign-in, doesn’t automatically mean customer data was accessed or stolen — but the credential and privilege changes made during the intrusion could function as a backdoor that persists even after the original compromised app is remediated. ## What Is ARTEX? ARTEX is described by Microsoft as an open-source, multi-agent penetration-testing framework built in Go with a Next.js frontend, capable of running an autonomous offensive security operation — from reconnaissance through data exfiltration — with little human input. It can work with any underlying AI model and defaults to English, though it can also operate in Korean, Mandarin, Spanish, or Japanese. Microsoft said it has observed threat actors across multiple regions using the framework, and that ARTEX had separately been linked to breaches at Korean financial institutions disclosed earlier in October. The broader pattern Microsoft is flagging isn’t specific to this one incident: agentic AI tools let attackers run around the clock, attempt multiple intrusion paths in parallel, and compress what used to be days or weeks of manual reconnaissance into hours. That compression is the real shift — defenders get the same volume of alerts they always did, just with almost no time window to act on them before access is already achieved. It echoes a broader trend of AI systems increasingly showing up on both sides of the security ledger, including cases where AI tools themselves have been [used to flag critical vulnerabilities](https://officechai.com/ai/openais-gpt-5-6-sol-helped-flag-the-critical-php-bug-flaw-thats-had-the-internet-scrambling/) before attackers could exploit them at scale. ## Mitigation Guidance Microsoft is urging affected organizations to keep ConnectWise application connections disabled until the vendor issues formal restoration guidance, and to avoid deleting enterprise applications as a first response, since doing so can destroy evidence needed for investigation. It recommends reviewing every tenant where the affected applications were ever installed, searching by application ID rather than display name, and preserving Entra sign-in and audit logs, Purview audit records, and any available SIEM data going back to at least October 1. Organizations are also advised to separately review successful and failed service-principal sign-ins, check for new credential additions or ownership changes on applications, and look for privileged role assignments or Conditional Access changes that weren’t authorized. Microsoft has published detection rules for its Defender XDR and Defender for Cloud Apps customers, along with advanced hunting queries to identify affected applications and trace their subsequent Graph API activity. The incident adds to a string of software supply chain scares this month. It follows closely on the heels of the [critical PHP vulnerability](https://officechai.com/stories/php-rushes-out-emergency-patch-for-two-critical-flaws-after-vulnerability-details-leak-online/) that prompted emergency warnings from [governments around the world](https://officechai.com/stories/japans-prime-minister-usas-fbi-take-to-x-warning-people-over-the-php-vulnerability/), a breach at the cloud deployment platform [Railway](https://officechai.com/stories/cloud-platform-railway-discloses-security-breach-pauses-all-deployments-as-customer-secrets-may-have-been-exposed/), and a certificate key compromise that has already cost Indian digital trust firm [eMudhra](https://officechai.com/stories/emudhra-has-lost-%e2%82%b91450-crore-in-market-cap-in-2-days-since-certificate-key-compromise-came-to-light/) over ₹1,450 crore in market value. Taken together, they point to a year where the speed of exploitation, increasingly aided by AI on the attacker’s side, is outpacing how quickly most enterprises can detect and respond.