Microsoft assesses that a China-aligned actor used an open-source agentic AI framework to scale a vendor compromise into automated intrusion attempts against thousands of cloud tenants.
Intelligence Lead
Microsoft Threat Intelligence assesses that Storm-0940, a China-state aligned actor, used the open-source ARTEX framework to automate reconnaissance, password spraying and OAuth abuse after compromising identities tied to ConnectWise cloud applications. The reported effect is speed: in several cases the time from targeting a victim to privileged cloud access was under three hours. The majority of targeting was unsuccessful, but the method lowers the labour cost of supply chain exploitation for any actor able to obtain a trusted vendor credential.
Situation Report
Microsoft published its findings on 21 October and updated the page on 26 October. It assesses that Storm-0940 was responsible for the recently disclosed compromise of a ConnectWise multi-tenant application. After gaining control of the identities of several ConnectWise cloud applications, the actor's AI agents reportedly used those application credentials to authenticate into customer Microsoft 365 tenants, relying on the trust the apps already held, so no interactive user sign-in was required. In some tenants the agents went on to Microsoft Graph and directory operations: reconnaissance, application credential changes for persistence, and changes to identities, groups and privileged roles.
Microsoft reports that downstream sign-in attempts reached more than 2,250 tenants. It separately describes a password-spray campaign between 10 and 14 October from a single IP address, 144.172.64.99, that produced more than 151,000 failed logons against 327 accounts at eight organisations, peaking at about 2,900 failures a minute on 11 October. Microsoft says it saw no successful authentication, token issuance, Graph call or directory change in that particular spray. It describes "multiple customer environments" showing follow-on activity but does not give a single confirmed count of compromised tenants.
ConnectWise published an initial advisory on 16 October covering attempted unauthorised access associated with Cloud Backup and later expanded its disclosures and containment guidance, according to Microsoft. The Microsoft report does not describe how the initial ConnectWise compromise occurred, and no ConnectWise statement is quoted in it. Microsoft states the activity did not result from a vulnerability in its own products, and that an affected app appearing in a tenant does not by itself show data was accessed or exfiltrated.
Background & Context
Microsoft describes Storm-0940 as active since 2021, with no known industry aliases, and focused on data theft. Its historical tradecraft is password spraying and exploitation of internet-facing applications, followed by persistence through credentials added to existing OAuth applications and mailbox collection through Microsoft Graph. The targeting list Microsoft attributes to the group's ARTEX activity is broad: aerospace and defence, government, military, semiconductors, energy, legal, media, and think tanks, among other sectors.
ARTEX is a multi-agent system, written in Go with a Next.js interface, that can drive any AI model to run a penetration test from reconnaissance through exfiltration with little human input. Microsoft says actors in multiple regions use it, and notes public reporting this month of its use in personal-data breaches at Korean financial institutions. The tool is dual-use by design, which complicates attribution by tooling alone.
The incident also follows a run of October disclosures in which trusted remote-management and support software was the entry point, including the BeyondTrust compromise attributed to the China-nexus group Armory Castle. Remote-management vendors hold standing access across many customers, which is why they recur as targets.
Analysis & Assessment
The attribution rests on Microsoft's own telemetry and is presented as an assessment; the report text gives no formal confidence rating, and no government has yet publicly endorsed it. This brief grades the attribution as moderate confidence. The supply chain access and the ARTEX use are better documented than the link to Beijing.
The analytically significant point is tempo, not novelty. Password spraying and OAuth abuse are established techniques. What Microsoft describes is their orchestration by autonomous agents at a rate of thousands of attempts a minute against thousands of tenants, with privileged access in under three hours where it succeeded. That compresses the defender's window between a vendor-side compromise and tenant-side impact. It is likely that detection built around slow, human-paced intrusion will lag, and that accounts with lockout policies absorb most of the noise: Microsoft reports lockouts accounted for roughly 98 per cent of the spray activity.
The reported failure rate cuts both ways. It indicates that basic controls, including lockout, least-privilege app consent and credential rotation, still defeat most of this activity. It also suggests the actor accepted a low hit rate because scale is cheap. Expect other state-aligned and criminal groups to adopt the same pattern against vendors that hold delegated tenant access.