Microsoft has uncovered that a China-linked advanced persistent threat (APT) group has been employing the open-source AI penetration testing tool Artex to launch a series of sophisticated attacks on ConnectWise systems. This campaign has targeted a multitude of organizations, bringing to light substantial cybersecurity concerns.
Background of the Cyber Attacks
Identified as Storm-0940, the threat actor has been active since at least 2021. The group is notorious for employing techniques such as password spraying and exploiting vulnerabilities in internet-facing applications. Their targets span across various sectors, underscoring the widespread impact of their operations.
In early September 2026, the malicious actors began leveraging Artex to automate their attack processes. Previous reports by cybersecurity firms such as CrowdStrike and Zscaler have linked this AI-driven activity to breaches on South Korean financial entities, demonstrating the global reach of these attacks.
Recent Exploitation of ConnectWise
By mid-October, Storm-0940 had intensified its operations by targeting ConnectWise clients. This prompted ConnectWise to halt several services, including Cloud Backup and SaaS Security, in an effort to mitigate potential damage. These actions reflect the severe threat posed by such AI-assisted cyber intrusions.
Huntress’s observations revealed that attackers utilized compromised ConnectWise credentials to infiltrate hundreds of Microsoft 365 tenants, affecting over 300 Entra tenants. This highlights the extensive access gained by the threat actors through their sophisticated methods.
Technical Insights and Recommendations
According to Microsoft, Artex was instrumental in speeding up reconnaissance, password spraying, and OAuth application abuse, executing over 2,900 attempts per minute. This level of automation allowed Storm-0940 to target more than 2,250 tenants rapidly.
The attackers successfully accessed customer environments using multiple ConnectWise cloud application identities, as evidenced by over 151,000 failed logon attempts recorded by Microsoft. In some cases, the threat actors advanced to Microsoft Graph and directory operations, modifying credentials to ensure continued access.
Microsoft advises organizations to scrutinize service principal sign-ins and monitor Microsoft Graph activities to identify suspicious patterns. Correlating these events with legitimate administrative activities is crucial for detecting unauthorized access.
Conclusion and Future Outlook
The use of AI tools like Artex in cyber attacks represents a significant evolution in threat actor capabilities. As Storm-0940 continues its operations across various industries, organizations must remain vigilant and bolster their cybersecurity defenses. The recent technical analysis by Zscaler provides further insights into the attack methodologies and configurations employed by this APT, offering valuable information for enhancing security measures.
