Microsoft attributes the ConnectWise supply-chain attack to China-aligned Storm-0940 using an AI agent framework
Microsoft says the group used the ARTEX agentic penetration-testing framework to reach more than 2,250 Microsoft 365 tenants.
Evidence: Official disclosure. Security stories run only with a named disclosure or independent reporting behind them.
Microsoft has attributed the recent supply-chain attack on ConnectWise customers' Microsoft 365 environments to a China-state aligned threat actor it tracks as Storm-0940. In a blog post on Wednesday, Microsoft Security Research said that as early as September 2026, the group used ARTEX, an agentic AI penetration-testing framework, to automate attacks on hundreds of organizations worldwide. According to the researchers, the automation let the group reach more than 2,250 tenants at 2,900 sign-in attempts per minute. Microsoft says Storm-0940 has been active since 2021. Its targets include aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits. Just before the compromise of ConnectWise's cloud backup service, the group ran a widespread password-spraying campaign that did not succeed. The attribution adds a nation-state actor and AI-driven automation to an incident that had already led ConnectWise to suspend the backup service. It is another documented case of attackers using agent frameworks to run intrusion campaigns at a scale and speed that are hard to reach by hand.
Sources
- Microsoft Security BlogAI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | Microsoft Security Blog
- CyberScoopMicrosoft pins ConnectWise supply-chain attack to China-state aligned threat group
- The Hacker NewsChina-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack