Storm-0940 used agentic AI to attack ConnectWise: the gap is no longer the tool, it's the speed

By BankInfoSecurity · October 22, 2026.

Microsoft is linking the ConnectWise supply-chain compromise disclosed last week to a broader campaign by a China-aligned actor it tracks as Storm-0940. According to the company, the group used agentic AI to automate penetration-testing tasks. In other words, AI systems carried out chains of offensive actions on their own.

The tool is an open-source framework called Artex. Microsoft describes it as a system built on a large language model (LLM) that can work with agents from any model and direct them through offensive security workflows, from reconnaissance to data exfiltration.

The figures Microsoft provides:

- Storm-0940 has used Artex since September to automate attacks against hundreds of targets worldwide, including recent breaches at South Korean financial institutions. - After gaining unauthorized access to ConnectWise, the group tried to log in to more than 2,250 tenants (customer cloud instances) at a rate of 2,900 attempts per minute. - Artex helped the actor gain administrator access to cloud infrastructure and cut privilege escalation to under three hours. - Between October 10 and 14, a *password spraying* campaign (trying a few common passwords against many accounts) targeted more than 300 accounts at eight organizations. It generated more than 150,000 failed logins, peaking at close to 3,000 per minute. According to Microsoft's telemetry, none succeeded.

Reports about ConnectWise emerged shortly afterward and cited indicators of compromise that matched those of that campaign, including an IP address. ConnectWise disclosed the incident on Friday after detecting unauthorized access attempts against its cloud backup and restore software. Businesses and managed service providers use that tool to back up their customers' Microsoft 365 and Google Workspace data.

On the same day as the vendor's notice, the firm Huntress said the attacker had accessed customers' Microsoft 365 environments through an API secret stolen from that software. According to Microsoft, the agents kept authenticating from the same IP range with the stolen application credentials, exploiting the trust each tenant had already granted them. In some environments they did more than authenticate: they carried out reconnaissance, modified application credentials and changed identities, groups and privileged roles in Microsoft Graph. Those changes can act as backdoors and preserve access even after the original compromised application is fixed.

**Our take.** The attribution to a “China-aligned” actor comes from Microsoft and should be treated as such. It is the analysis of a company with privileged telemetry, not a verdict anyone outside can verify. What is solid, because the report itself describes it, is the pattern. Password spraying, OAuth application abuse and lateral movement have been in this group's repertoire for years; it has been active since 2021. What is new is the pace: AI turns familiar tactics into machine-speed operations.

That fits a thesis we have argued for some time: the real near-term danger of agentic AI is not a distant superintelligence but the industrialization of familiar intrusions and fraud. When scanning, testing credentials and escalating privileges cost almost nothing, the advantage goes to the attacker who scales. Whoever automates wins. The defender who relies on a person to review alerts and coordinate the response loses. Microsoft puts it plainly: the volume of logs generates alerts, but the speed leaves little time for coordinated remediation.

The case also shows why managed service providers are such a lucrative target. A single API secret stolen from one provider brings pre-established trust across many customers. More broadly, supply-chain security tends to break down precisely where a single tool holds broad permissions over many environments.

In fairness, there is a caveat. Artex is open source and works with agents from any model, so the capability does not depend on a single lab, and restricting one particular model will not stop it. The same automation can, however, strengthen defense. If the attacker operates at machine speed, the response has to as well: automated detection, immediate revocation of application credentials and secret rotation, with humans setting policy rather than reacting to every alert.

The long-term outlook is still favorable. Digital infrastructure that defends itself, with agents watching other agents, is a safer foundation for an economy of abundance. But the transition will be uncomfortable, and this episode is a reminder that whoever automates first sets the terms in the short term. The useful question for any organization is not whether the attacker uses AI, but whether its defenses can react in minutes rather than days.