A China-linked threat actor known as Storm-0940 has been using the open‑source AI penetration testing framework Artex to automate intrusions into ConnectWise customers’ environments, Microsoft reported. The activity, active since at least 2021, ramped up in early September and continued into mid‑October 2026, when Artex was employed to accelerate reconnaissance, password spraying, and OAuth application abuse as part of a wider ConnectWise supply‑chain compromise. Microsoft noted the group targeted hundreds of organisations across multiple sectors and that several ConnectWise services were suspended in response.
Huntress observed the attackers using compromised ConnectWise credentials to access more than 300 Microsoft 365 tenants, including over 300 Entra tenants, at a pace of over 2,900 login attempts per minute. Microsoft described 151,000+ failed logon events alongside some successful authentications using ConnectWise cloud app identities. In affected environments, the attackers progressed to Microsoft Graph and directory operations, modifying credentials to maintain persistence even after remediation.
Microsoft urged organisations to correlate service‑principal sign‑ins with subsequent Graph activity and directory changes to detect and respond to such AI‑accelerated intrusions. Storm‑0940 has targeted organisations across aerospace, automotive, chemicals, defence, energy, finance, government, and other sectors, as well as non‑profits.