Microsoft blames Storm-0940 for ConnectWise compromise carried out with ARTEX agent
Microsoft attributes the ConnectWise compromise to Storm-0940, a China-state aligned actor, which used the agentic AI penetration testing framework ARTEX to automate its attacks.
By GennnAi··1 min read
Since September 2026 at the earliest, Storm-0940 has used ARTEX to automate attacks on hundreds of organizations worldwide. Several of these attacks gave privileged access to cloud infrastructure, sometimes in under three hours. The actor, active since 2021, abused already-authorized applications to reach Microsoft 365 environments without interactive sign-in. Microsoft says no vulnerability in its own systems was involved, and customers should follow ConnectWise's containment guidance.
Source: Microsoft Threat Intelligence, published on October 21, 2026.