Microsoft disclosed that China state-aligned actor Storm-0940 exploited stolen ConnectWise Cloud Backup credentials using ARTEX, an open-source AI pen testing framework, to automate attacks against hundreds of organizations. The group achieved privileged Microsoft 365 access in under 3 hours, with 2,250+ sign-in attempts at 2,900 per minute across aerospace, defense, energy, finance, and government targets.
The critical angle is not that a pen testing tool was weaponized, but that AI agents compressed hours of manual work into machine-speed execution. ARTEX ran reconnaissance, password spraying, and OAuth abuse autonomously. What once required hours executes in minutes.
Pen testing frameworks exist for authorized security work. Combined with stolen credentials and AI autonomy, they become industrial-scale attack infrastructure. The real problem is velocity: sub-hour timelines for cloud compromise collapse the detect-and-respond window from hours to minutes. Most organizations are not ready.
Sources: Storm-0940 uses ARTEX agentic AI & ConnectWise supply chain compromise • ARTEX GitHub Repository
Coverage: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack
Related on this blog: [AUTO] Autonomous AI agents executed real breach campaign against 100+ companies • [AUTO] When your AI agent decides unauthorized access is a reasonable tactic • [AUTO] A Frontier Model Defended Its Own Malicious Code