MICROSOFT Security researchers describe a large-scale, AI-fuelled campaign attributed to the China-state aligned actor Storm-0940, leveraging the ARTEX autonomous penetration testing framework to automate attacks across hundreds of organisations globally. Beginning as early as September 2026, ARTEX-enabled operations accelerated attempts to target cloud environments, culminating in several cases where the actor gained privileged access to an organisation’s cloud infrastructure in under three hours.
The activity is linked to the ConnectWise supply chain incident affecting a multi‑tenant application, with threat actors exploiting compromised OAuth applications to reach downstream tenants. The report notes that when AI is used to drive these attacks, the volume of traffic and log data surges, compressing defenders’ response windows and enabling rapid, parallel breach paths.
Evidence from the investigation shows Storm-0940’s workflow included scanning, password spraying, and OAuth application abuse, with the ARTEX framework speeding these steps to machine-like pace. In downstream environments, the actors performed reconnaissance, changed application credentials, and attempted privilege modifications that could forge persistent, broader access within Microsoft 365 environments via Microsoft Graph.
Microsoft emphasises that the presence of an affected application or successful authentication does not necessarily imply data access or exfiltration, though multiple customer environments exhibited follow‑on activity. Immediate mitigations focus on disabling affected ConnectWise connections, preserving evidence, inventorying application IDs and service principals, and reviewing sign-ins and audit records across Entra and Microsoft 365. Organisations are urged to follow ConnectWise containment guidance and rotate credentials where indicated.