China-Linked APT Leverages AI-Driven Artex Framework to Automate ConnectWise Intrusions
A sophisticated, China-linked threat actor known as Storm-0940 has significantly escalated the velocity of its cyber operations by integrating the open-source artificial intelligence penetration testing framework, Artex, into its attack lifecycle. Recent intelligence indicates that the group, which has been active since 2021, successfully utilized this AI-powered tooling to orchestrate a widespread campaign targeting ConnectWise customers in mid-October 2026.
Accelerated Reconnaissance and OAuth Abuse
The transition to AI-automated attack sequences has allowed Storm-0940 to move beyond manual intervention, achieving machine-speed execution in several critical stages of the intrusion process. Microsoft researchers observed the threat actor deploying Artex to facilitate rapid reconnaissance, password spraying, and sophisticated OAuth application abuse. The automation enabled the attackers to conduct over 2,900 authentication attempts per minute, resulting in more than 151,000 failed logon events while simultaneously securing unauthorized access to hundreds of Microsoft 365 and Entra tenants.
Once initial authentication was achieved using compromised ConnectWise application credentials, the AI agents managed by the threat actor proceeded to automate post-exploitation tasks. This included interacting with the Microsoft Graph API to conduct deep directory reconnaissance, modifying application credentials to ensure long-term persistence, and adjusting identities, groups, and privileged roles within the victim environments. By programmatically altering these credentials, the attackers established a foothold that remained resilient even after initial remediation efforts were attempted by the affected organizations.
Broad Targeting and Industry Impact
The campaign represents a shift toward more aggressive, automated exploitation of third-party software supply chains. Since early September 2026, the use of Artex has been identified in attacks spanning a diverse range of sectors, including aerospace, automotive, defense, financial services, energy, manufacturing, and government. The scale of the targeting suggests a strategic effort to gain high-level access across critical infrastructure and technology providers.
In response to the surge in malicious activity, ConnectWise took proactive measures to suspend several impacted services, including its Cloud Backup, SaaS Security, and Cloud Management modules. Industry observers, including Huntress, confirmed that the attackers successfully leveraged compromised credentials to pivot into victim environments, highlighting the risks associated with interconnected SaaS applications.
Defensive Recommendations
Security teams are urged to conduct a thorough audit of their environment, specifically focusing on service principal sign-ins. Organizations should correlate these logins with subsequent activity within the Microsoft Graph, paying close attention to unexpected directory changes and modifications to administrative roles. Establishing a baseline for authorized administrative behavior is essential for detecting the subtle, AI-accelerated movements that characterize this threat actor’s current methodology. As Storm-0940 continues to refine its configuration and synchronization scripts, the ability to rapidly identify and revoke illicitly modified application credentials remains a primary defense against persistent unauthorized access.
