A China-aligned espionage group exploited a ConnectWise vulnerability to compromise 2,250 Microsoft 365 tenants in October 2026, using a publicly available open-source AI framework to move from initial breach to privileged cloud access in under three hours.
Storm-0940 deployed ARTEX, an agentic AI penetration-testing system, after gaining initial access through the ConnectWise flaw. The group used password spraying (151,000+ attempts) and OAuth abuse with stolen ConnectWise credentials to escalate rapidly across hundreds of organizations in aerospace, defense, energy, finance, government, and tech.
Under three hours from compromise to cloud admin access means traditional incident response is already behind. ARTEX is open-source and available to anyone; state-level operators have the resources to refine it for their own purposes.
Sources: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Coverage: AI agents used in ConnectWise breach affecting 2,250 cloud tenants • October 2026 Cloud Backup Incident
Related on this blog: [AUTO] Attackers Poison the Data Chatbots Use • [AUTO] Hidden Ads Target AI Models at Publisher Level • [AUTO] AI Agents as Supply-Chain Attack Surface