Microsoft: Storm-0940 Used ARTEX Against ConnectWise Downstream Tenants

Microsoft says a China-state aligned actor it tracks as Storm-0940 used ARTEX, an open-source framework in which LLM agents run a penetration test on their own, against downstream tenants after the ConnectWise Cloud Backup credentials were compromised. In its October 21 write-up, Microsoft reports multiple instances where the time from initial targeting to privileged access was under three hours. It also says most of the targeting failed.

What Microsoft attributes

Microsoft assesses that Storm-0940 was responsible for the compromise of ConnectWise Cloud Backup, a multi-tenant application that customers authorise inside their Microsoft 365 tenants. It describes the actor as active since 2021, with no known industry aliases, and does not give a formal confidence level. It states the activity did not result from a compromise of, or vulnerability in, its own systems.

Adversary Wire covered the earlier, unattributed stage of this incident in its ConnectWise briefing. The new element is the tooling. Microsoft ties ARTEX to the downstream stage and does not say it was used to obtain the ConnectWise credential.

How ARTEX works

By Microsoft’s description, ARTEX is a multi-agent LLM system written in Go with a Next.js frontend. Its agents move from reconnaissance to data exfiltration with little human interaction, and they accumulate discovered assets and vulnerabilities into a graph. The interface and output default to English but can be switched to Korean, Mandarin, Spanish or Japanese. Microsoft says it can drive any AI model.

Microsoft reports ARTEX use by Storm-0940 as early as September 2026, and says multiple threat actors across regions are using it. Recorded Future’s TAG-217 used the same framework against South Korean banks. Microsoft does not link the two actors, and our TAG-217 coverage reports no link.

The campaign in numbers

Microsoft’s figures come from different scopes, so we keep them apart:

• A password-spray campaign from October 10 to 14 targeted 327 accounts across eight organisations, with more than 151,000 failed logons. Peak failures reached 2,900 per minute on October 11. Microsoft says no successful authentication, token issuance, Graph call or directory change was observed in that campaign.
• After the ConnectWise credentials were compromised, the actor used ARTEX to attempt sign-ins to more than 2,250 tenants.
• In some environments, the activity moved into Microsoft Graph and directory operations: application credential additions for persistence, changes to identities, groups and privileged roles, and bulk secret reads across multiple Azure Key Vaults (the last appears in Microsoft’s detection mapping, not its narrative).

Microsoft’s body text keeps the 2,250 and 2,900 figures apart, but its infographic puts them side by side and CyberScoop quotes Microsoft as joining them. Our reading: 2,900 per minute is the spray’s peak failure rate (body text), and 2,250 is the number of tenants with sign-in attempts. Microsoft’s graphic says “attempts per minute” where the text says “failures per minute”, and it does not define the pairing.

What changes for defenders

In our assessment, the lesson is tempo, not novelty. Each technique here, password spraying, abused service principals, Key Vault reads, is established tradecraft. What agents add is the ability to run those steps across many tenants at once and chain them without waiting for an operator. Microsoft’s multiple sub-three-hour cases leave little room for a ticket queue.

In our reading, Microsoft’s guidance centres on identity telemetry, not on spotting AI:

• Search for the affected ConnectWise applications by application ID, not display name. Microsoft lists 506e08f9-6e9a-4da4-942b-a099a03644ae for Cloud Backup.
• Review service-principal sign-ins from at least October 15, ideally from October 1, and review failed and successful sign-ins separately.
• Audit credential additions, owner changes, role assignments, consent grants and Conditional Access changes.
• Keep affected ConnectWise connections disabled until ConnectWise issues restoration instructions, and preserve evidence before deleting applications.

Two caveats apply. Attribution rests on Microsoft’s assessment alone, and the write-up does not say whether ARTEX was used in every Storm-0940 intrusion. We also read Microsoft’s post only as extracted text, so exact wording should be checked against the original. We found no independent confirmation as of October 23, 2026, but our only sources are Microsoft and CyberScoop, which repeats Microsoft, so that is weak evidence.

References

• Microsoft Security Blog: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise
• CyberScoop: coverage of Microsoft’s Storm-0940 disclosure