{"slug": "microsoft-blames-chinese-state-hackers-for-the-connectwise-supply-chain-attack", "title": "Microsoft blames Chinese state hackers for the ConnectWise supply chain attack", "summary": "Microsoft attributed last week's supply chain attack on Microsoft 365 tenants to the China-state-aligned group Storm-0940, which used an open-source AI penetration testing tool called ARTEX to compromise ConnectWise's OAuth app, the company said in a blog post Wednesday. Microsoft said Storm-0940 used ARTEX \"to automate attacks targeting hundreds of organizations globally across a broad range of industries,\" and that several ARTEX-driven attacks gave the actor privileged access to cloud infrastructure, with multiple cases reaching privileged access in under 3 hours from initial targeting. Storm-0940 is known for password-spray attacks against US companies.", "body_md": "The group behind last week's supply chain attack on Microsoft 365 tenants used an open-source hacking tool developed in China to compromise ConnectWise's OAuth app, according to Microsoft.\n\nARTEX is [an AI penetration testing tool licensed under the AGPL](https://github.com/BaaRai/ARTEX?ref=thestack.technology), and it was used by a known hacking group called Storm-0940 \"to automate attacks targeting hundreds of organizations globally across a broad range of industries,\" Microsoft [said in a blog post](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/?ref=thestack.technology) Wednesday. Storm-0940 is \"a China-state aligned actor,\" the company said, and [it is known for launching password-spray attacks](https://foresiet.com/blog/storm-0940-chinese-cyber-espionage-tactics/?ref=thestack.technology) at US companies.\n\n\"Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours,\" Microsoft said.", "url": "https://wpnews.pro/news/microsoft-blames-chinese-state-hackers-for-the-connectwise-supply-chain-attack", "canonical_source": "https://www.thestack.technology/microsoft-blames-chinese-state-hackers-for-the-connectwise-supply-chain-attack/", "published_at": "2026-10-22 17:45:23+00:00", "updated_at": "2026-10-22 18:13:28.737679+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence"], "entities": ["Microsoft", "Storm-0940", "ConnectWise", "ARTEX", "Microsoft 365"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/microsoft-blames-chinese-state-hackers-for-the-connectwise-supply-chain-attack", "markdown": "https://wpnews.pro/news/microsoft-blames-chinese-state-hackers-for-the-connectwise-supply-chain-attack.md", "text": "https://wpnews.pro/news/microsoft-blames-chinese-state-hackers-for-the-connectwise-supply-chain-attack.txt", "jsonld": "https://wpnews.pro/news/microsoft-blames-chinese-state-hackers-for-the-connectwise-supply-chain-attack.jsonld"}}