Microsoft says Storm-0940 used ARTEX in ConnectWise supply-chain compromise

Microsoft says Storm-0940 used ARTEX to accelerate a supply-chain compromise involving ConnectWise.[3] It says the campaign enabled the abuse of application credentials across Microsoft 365 environments.[3] Tribune India reported that the credentials compromised in the incident were associated with ConnectWise’s Cloud Backup application.[2] Microsoft described the activity as a large-scale, nation-state operation using ARTEX.[3] The reported target figure is more than 2,250 Microsoft 365 tenants.[1]

SecurityWeek characterized ARTEX as an open-source AI penetration-testing framework, while Wiz described it as an autonomous AI penetration-testing agent.[4][5] Wiz says a Chinese developer published the tool on GitHub in July 2026 and that it won Baidu’s Agent+ red-team challenge that September.[5] Wiz says the developer made ARTEX closed-source on October 8, by which time it had more than 12,000 forks.[5] Wiz describes its design as a planner agent choosing steps and worker agents running tools, with results added to a shared graph.[5]

Microsoft has tracked Storm-0940 since 2021, and SecurityWeek described it as active since at least that year.[2][4] SecurityWeek reported that the actor began using ARTEX to automate attacks in early September 2026 and that the campaign targeted hundreds of organizations.[4] The Register reported that attackers gained privileged access in some environments in under three hours.[1] Wiz observed ARTEX-associated activity targeting Okta, Entra and Cognito, along with Microsoft 365 integrations, and said its observations overlapped with Microsoft’s reporting on Storm-0940.[5] These reports do not establish that every targeted tenant was compromised or that every observed activity was attributable to Storm-0940.