Microsoft blames Chinese state hackers for the ConnectWise supply chain attack

Microsoft attributed last week's supply chain attack on Microsoft 365 tenants to the China-state-aligned group Storm-0940, which used an open-source AI penetration testing tool called ARTEX to compromise ConnectWise's OAuth app, the company said in a blog post Wednesday. Microsoft said Storm-0940 used ARTEX "to automate attacks targeting hundreds of organizations globally across a broad range of industries," and that several ARTEX-driven attacks gave the actor privileged access to cloud infrastructure, with multiple cases reaching privileged access in under 3 hours from initial targeting. Storm-0940 is known for password-spray attacks against US companies.

The group behind last week's supply chain attack on Microsoft 365 tenants used an open-source hacking tool developed in China to compromise ConnectWise's OAuth app, according to Microsoft. ARTEX is an AI penetration testing tool licensed under the AGPL https://github.com/BaaRai/ARTEX?ref=thestack.technology , and it was used by a known hacking group called Storm-0940 "to automate attacks targeting hundreds of organizations globally across a broad range of industries," Microsoft said in a blog post https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/?ref=thestack.technology Wednesday. Storm-0940 is "a China-state aligned actor," the company said, and it is known for launching password-spray attacks https://foresiet.com/blog/storm-0940-chinese-cyber-espionage-tactics/?ref=thestack.technology at US companies. "Several of these Storm-0940 ARTEX-driven attacks have resulted in the actor obtaining privileged access to an organization’s cloud infrastructure – including multiple instances where the time from initial targeting to privileged access was less than 3 hours," Microsoft said.