# Microsoft blames Chinese state hackers for the ConnectWise supply chain attack

> Source: <https://www.thestack.technology/microsoft-blames-chinese-state-hackers-for-the-connectwise-supply-chain-attack/>
> Published: 2026-10-22 17:45:23+00:00

The group behind last week's supply chain attack on Microsoft 365 tenants used an open-source hacking tool developed in China to compromise ConnectWise's OAuth app, according to Microsoft.

ARTEX is [an AI penetration testing tool licensed under the AGPL](https://github.com/BaaRai/ARTEX?ref=thestack.technology), and it was used by a known hacking group called Storm-0940 "to automate attacks targeting hundreds of organizations globally across a broad range of industries," Microsoft [said in a blog post](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/?ref=thestack.technology) Wednesday. Storm-0940 is "a China-state aligned actor," the company said, and [it is known for launching password-spray attacks](https://foresiet.com/blog/storm-0940-chinese-cyber-espionage-tactics/?ref=thestack.technology) at US companies.

"Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours," Microsoft said.