Latest / Government and geopolitics
Microsoft says a China-aligned group used the ARTEX AI tool in the ConnectWise supply-chain attack
See how this story connectsMicrosoft said Storm-0940, a China state-aligned actor, used ARTEX, an agentic AI penetration testing framework, from as early as September 2026 to automate attacks on hundreds of organisations worldwide, and assessed that it was behind the recently disclosed compromise of the ConnectWise Cloud Backup multi-tenant application. Several ARTEX-driven attacks gave the actor privileged access to cloud infrastructure, in some cases less than three hours after initial targeting. In the ConnectWise incident it tried to sign in to more than 2,250 Microsoft 365 tenants at 2,900 attempts a minute, and used applications that already had access to reach target environments without an interactive sign-in.
Why it matters
A state-aligned group used an agentic AI tool to compromise a software supplier and move against its customers within hours.
- When
- 21 Oct 2026
- ID
WTA-N-2026-0512- Where
- International, China, United States
- Who
- Microsoft, ConnectWise, Storm-0940
- Topics
- Cybersecurity, AI agents, AI incidents
- System
- ARTEX agentic AI penetration testing framework
- Operator
- Storm-0940, a China state-aligned actor (attribution by Microsoft)
- Type
- supply-chain compromise of ConnectWise Cloud Backup and automated attacks on hundreds of organisations
- Status
- disclosed 21 Oct 2026; disclosed by Microsoft Threat Intelligence · Incident ledger
Summary written with AI by wheresthe.ai, from Microsoft Security Blog and the reporting credited above. Checked against the source on 29 Oct 2026.
Source copy: saved on 29 Oct 2026 to check this story and not republished, because the text belongs to its publisher. Also held by the Internet Archive.
Cite this story
WTA-N-2026-0512: “Microsoft says a China-aligned group used the ARTEX AI tool in the ConnectWise supply-chain attack.” wheresthe.ai, 21 Oct 2026. https://wheresthe.ai/d/intl-microsoft-ties-storm-0940-artex-connectwise-compromise-2026-10/ (source: Microsoft Security Blog).
Spotted an error? Email [email protected].