China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Summary

Microsoft reportedly attributed a ConnectWise Cloud Backup supply-chain compromise to Storm-0940, a China state-aligned actor. The campaign used ARTEX, a Go-based agentic AI penetration-testing framework, to accelerate reconnaissance, password spraying, and abuse of trusted OAuth applications. The broader activity reportedly targeted hundreds of organizations worldwide since September 2026, including defense, energy, financial services, government, manufacturing, and technology organizations.^[0]

The reported sequence distinguishes unsuccessful password spraying from subsequent access through compromised application identities. Between October 10 and 14, infrastructure at 144.172.64.99 generated more than 151,000 failed logons against 327 accounts across eight organizations, without detected successful authentication or downstream Graph or directory activity. On October 15, the agents reportedly gained access to multiple ConnectWise cloud application identities and used stolen application credentials to enter customer environments through permissions those applications already held. The article does not explain how those credentials were acquired or establish that the preceding spray obtained them.^[0]

The principal downstream concern is persistence beyond the initially compromised integration. Microsoft assessed that agents in some environments progressed from authentication to reconnaissance, application credential changes, and operations involving identities, groups, and privileged roles. The report warns that unauthorized credential changes can preserve access through other identities and services even after the original application is remediated. ConnectWise temporarily shut down services and was conducting phased restoration.^[0]

All incident findings in this dossier rest on one supplied news article, which quotes Microsoft and ConnectWise; the linked primary reports were not supplied for comparison. The article provides an actionable source IP and behavioral detail, but no CVE, affected version range, corrective patch, or technical account of the original application-credential compromise. The reported scale and AI attribution should therefore be read as attributed findings, not independently corroborated conclusions.^[0]

Attack chain

1. 1. Automated password spraying: Between October 10 and 14, 2026, Storm-0940 infrastructure at 144.172.64.99 reportedly sprayed 327 accounts across eight organizations for access to Microsoft 365 and Exchange Online. Microsoft recorded more than 151,000 failed logons and no successful authentication, token issuance, Graph call, or directory change during this window. This phase is not demonstrated to have produced the application credentials used later.^[0]
2. 2. Acquisition of ConnectWise application identities: On October 15, the agents reportedly gained access to the identities of multiple ConnectWise cloud applications. The supplied evidence does not describe the credential-acquisition mechanism.^[0]
3. 3. Authentication through existing customer trust: The agents used stolen application credentials to authenticate to customer environments, leveraging access already granted to the ConnectWise applications rather than requiring an interactive user sign-in. Microsoft reported continued authentication from the same IP range, but the article does not specify that range.^[0]
4. 4. Assessed downstream reconnaissance and persistence activity: In some environments, agents were assessed to have reached Microsoft Graph and directory operations. Reported follow-on activity included reconnaissance, application credential modifications intended to establish persistence, and changes involving identities, groups, and privileged roles. The report does not establish that every targeted tenant reached this stage.^[0]

Disclosure timeline

Actor profile

Storm-0940

Microsoft, as quoted in the supplied article, describes Storm-0940 as China state-aligned and attributes the ConnectWise Cloud Backup compromise to it. The actor is assessed as active since at least 2021 and was publicly detailed in November 2024 for evasive password spraying using Quad7, also known as CovertNetwork-1658. Its reported historical methods include exploitation of internet-facing applications, movement through environments using compromised accounts, and persistence by adding credentials to existing OAuth applications. Those historical methods do not establish the undisclosed initial compromise mechanism in this incident. ARTEX is reportedly used by other actors as well, so possession or use of that framework alone is not distinctive attribution evidence.^[0]

How it works

The described access mechanism is abuse of compromised cloud application credentials and pre-existing tenant trust, rather than a disclosed software vulnerability. Once the actor controlled ConnectWise application identities, it could authenticate through applications already authorized in customer environments. This allowed access without an interactive user sign-in; the article does not describe how the original application credentials were stolen.^[0]

The reported persistence mechanism was modification of application credentials within victim environments. Such changes could extend access through additional identities, credentials, or cloud services, leaving a backdoor after remediation of the original compromised application. The report also describes operations involving identities, groups, and privileged roles, but does not enumerate the exact changes or establish successful privilege expansion in every affected environment.^[0]

ARTEX reportedly accelerated execution of reconnaissance, password spraying, and application abuse. The broader ARTEX-enabled activity included some cases in which privileged cloud access followed initial targeting in less than three hours. This timing is not presented as a measured outcome for every ConnectWise customer, and the quantified October 10–14 spray itself had no detected authentication success.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• The decisive reported access path was compromised application identity, not demonstrated password-spray success. The acquisition method remains undisclosed.^[0]
• Existing third-party application trust enabled downstream access without interactive user authentication. Investigation must include application authentication and directory changes, not just user login failures.^[0]
• Remediating the original integration may not remove secondary persistence. Unauthorized application credentials and changes to other identities or cloud services require separate investigation.^[0]
• The scale figures describe different observations: more than 2,250 tenants faced attempted sign-ins, while the quantified October 10–14 spray involved 327 accounts across eight organizations. Neither figure is a confirmed compromise count.^[0]
• The supplied evidence supports a named-actor campaign narrative but remains single-source reporting. ARTEX is not unique to Storm-0940, and the article does not supply the original compromise mechanism, a CVE, or a patch-based resolution.^[0]

Defensive actions

• Hunt for 144.172.64.99 in Microsoft 365 and Exchange Online authentication records, particularly for October 10–14, 2026, and examine subsequent activity affecting the same accounts and tenants.: The address is the campaign's only explicit infrastructure indicator in the supplied evidence. The observed spray produced heavy failures without detected success, so a failure match should trigger investigation rather than be treated as proof of compromise.^[0]
• Review application-based and non-interactive authentication associated with ConnectWise cloud integrations from October 15 onward; do not restrict the investigation to interactive user sign-ins.: The reported downstream access used stolen application credentials and existing tenant permissions without requiring an interactive user sign-in. A user-sign-in-only investigation would not cover that access path.^[0]
• Audit Microsoft Graph and directory activity associated with implicated application identities, focusing on application credential changes and modifications involving identities, groups, and privileged roles.: These are the specific follow-on operations Microsoft assessed in some customer environments. They provide incident-specific investigative pivots beyond authentication records.^[0]
• Contain confirmed compromised application identities and remove unauthorized credentials and downstream identity changes; do not close remediation solely because the original ConnectWise application has been addressed.: The report explicitly warns that application credential modifications can establish persistence through other identities, credentials, and cloud services that remains after the original application is remediated.^[0]
• Review the permissions already granted to implicated ConnectWise applications when determining exposure, and distinguish attempted authentication from confirmed access and post-authentication changes.: The actor reportedly exploited established application trust. The report also separates a failed password-spray window, broader attempted tenant sign-ins, and assessed downstream operations; those observations do not establish equivalent impact across all targeted organizations.^[0]