Microsoft Says China-Aligned Hackers Turned an Agentic AI Pentest Framework Into a Weapon Against Hundreds of Organizations

Microsoft has published one of the most consequential threat intelligence reports of the year: a China-state-aligned hacking group tracked as Storm-0940 spent the past two months automating intrusions against hundreds of organizations using ARTEX, an open-source agentic AI penetration testing framework. The company assesses that the same campaign was behind the recently disclosed supply chain compromise of ConnectWise, a widely used IT management vendor whose cloud backup application holds trusted access to customer Microsoft 365 environments.

ARTEX is not custom malware built in a state laboratory. It is a Go-based, multi-agent pentesting framework with a Next.js frontend that was publicly available on GitHub and can be wired to any large language model backend. In legitimate hands it automates reconnaissance, vulnerability discovery and exploitation for authorized security tests. Microsoft says Storm-0940 used it to do the same work at attack scale, chaining autonomous agents that could run around the clock, on weekends and holidays, and pursue multiple breach paths simultaneously.

The supply chain angle is what turned a noisy scanning campaign into a serious breach. During the ConnectWise compromise, Storm-0940 gained control of identities for several ConnectWise Cloud Backup applications, which carry high-privilege credentials allowing them to authenticate into customer Microsoft 365 tenants without any interactive sign-in, phishing message or MFA prompt. The trusted application simply authenticated as itself, and the tenant was already configured to accept it.

The numbers in Microsofts report describe machine-speed offense. ARTEX-accelerated authentication attempts hit more than 2,250 Microsoft 365 tenant environments, at one point reaching roughly 2,900 attempts per minute. In a single campaign between October 10 and 14, Microsoft logged over 151,000 failed sign-in attempts against 327 accounts across eight organizations. In several incidents the time from initial targeting to privileged cloud access was under three hours, and in at least one environment a compromised ConnectWise application assigned itself the Global Administrator role.

Microsoft also observed AI-accelerated follow-on activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to modify privileges that would expand or persist access. Targeted sectors read like a defense briefing: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and nonprofits. Microsoft emphasized that most targets were not successfully breached, and that successful authentication does not prove data was stolen. The company said the activity did not result from any compromise of Microsofts own systems.

The report lands in the same week that the PHP project disclosed two critical remote code execution bugs found with the help of AI models, and days after Anthropic detailed how Claude surfaced hundreds of attack-surface issues in open-source code. The pattern is uncomfortable: the same agentic tooling that lets defenders audit thousands of configuration options lets attackers compress the reconnaissance-to-exploitation window to hours. ARTEX itself was pulled from public access after earlier attacks on South Korean financial institutions, but threat actors preserved copies, and Microsoft notes the barrier to running AI-augmented attacks is now little more than a set of stolen credentials and an LLM API key.

For ConnectWise customers, Microsofts guidance is concrete: disable affected Cloud Backup application connections until the vendor issues restoration instructions, preserve the enterprise application for forensics rather than deleting it, review service principal sign-ins from at least October 15, and hunt for new application credentials, unusual role assignments and unexpected Graph activity. Defender XDR detections and indicators, including infrastructure in the 144.172.64.x range, have been published. The deeper message is structural: any third-party application with persistent, high-privilege access to tenant environments is now a machine-speed attack surface, and the difference between a nation-state operation and a well-equipped criminal group is shrinking fast.