ARTEX AI: AI agents in the Chinese attack on ConnectWise

On October 21, Microsoft Threat Intelligence attributed the ConnectWise supply chain attack to Storm-0940, a China-based, state-linked group. According to Microsoft, the group ran the attack with ARTEX AI, an agentic AI framework for penetration testing, and tried to sign in to more than 2,250 tenants of Microsoft 365.

What actually happened?

ConnectWise sells software to IT companies that manage their clients’ infrastructure. The target was ConnectWise Cloud Backup (formerly SkyKick), a backup service with permissions to its customers’ Microsoft 365 data.

The timeline, according to Microsoft:

1. Since early September 2026, Storm-0940 has used ARTEX against hundreds of organizations worldwide.
2. October 10–14: automated password spraying from a single IP address hits 327 accounts in eight organizations, with more than 151,000 failed sign-ins and a peak of 2,900 attempts per minute. This phase did not produce a single successful sign-in.
3. October 15: the attackers take over the identities of several ConnectWise applications and use them to sign in to customer environments, with no interactive user sign-in at all.
4. October 16: ConnectWise publishes its first notice, and on October 17 it disables seven application identities and suspends Cloud Backup.

The most worrying number: in some cases, less than 3 hours passed from picking a target to privileged cloud access. One of the ConnectWise applications granted itself the Global Administrator role.

What is ARTEX AI?

It’s not a model but an agent harness for penetration testing: a multi-agent LLM system written in Go, with a Next.js interface, that can use any model. According to Microsoft, the agents work through the whole path from reconnaissance to data exfiltration on their own, collecting the assets and vulnerabilities they find into a graph.

According to Zscaler ThreatLabz, ARTEX was built in China and published on GitHub by a developer known as “Autumn-27”. After the abuse came to light, the author closed the code, but earlier copies and forks may still be circulating.

This isn’t the first time ARTEX has made headlines. On October 14, Zscaler described a campaign against South Korean financial companies that leaked the personal data of about 67,000 people. In that campaign ARTEX mainly used DeepSeek v4.1-flash, with GLM-5.3 and Grok handling extra reasoning. Interestingly, the attacker also asked Claude Code how to sell the stolen data and where to find Korean Telegram channels.

Microsoft did not say which model Storm-0940 used against ConnectWise.

What’s new here?

We’ve already seen AI agents in attacks with the Cairn AI cyberattack, and AI also helped find bugs in PHP2Shell. This time, though, it’s a state-linked group, a supply chain attack and an explicitly named agent framework. As Microsoft’s researchers write, it shows attackers “integrating agentic AI into existing offensive security workflows”.

Microsoft points to two advantages of agents: they work around the clock and can try several intrusion paths at once. The report puts it briefly: “Agents are not constrained by factors affecting humans”.

For balance: most attempts failed. Microsoft also notes that an application sign-in “does not necessarily indicate that customer data was accessed or exfiltrated”. A ConnectWise spokesperson told The Record there is no indication that backup data was compromised.

What to watch out for going forward?

If we use ConnectWise, Microsoft recommends a few steps:

1. Keep connections to ConnectWise applications disabled until ConnectWise issues official restoration guidance.
2. Search for the applications by application ID, not by display name, across all tenants.
3. Preserve Entra and Purview logs and review activity since at least October 15, and service principal sign-ins ideally since October 1.
4. Check for new credentials, roles and consents on the applications, because credentials added by the attackers can act as a backdoor even after the original application is removed.

The broader lesson applies to everyone: third-party applications with broad permissions in Microsoft 365 are an easy target today. It’s worth cutting their permissions to the minimum (and checking every now and then what has access to our tenant at all).

FAQ

Who is behind ARTEX AI?

According to Zscaler, the tool was built in China and published on GitHub by a developer called “Autumn-27”. After the abuse came to light, the code was closed.

Is ARTEX an AI model?

No. It’s a framework that orchestrates several models (e.g. DeepSeek, GLM, Grok) and splits tasks among them like a team of pentesters.

Did ConnectWise backup data leak?

There’s no evidence of that so far. ConnectWise found no signs of access to the encrypted archives, but admits it can’t see what happened inside customers’ tenants.

How many organizations were affected?

Microsoft reports sign-in attempts against more than 2,250 tenants. According to The Next Web, Huntress found almost 1,000 tenants with sign-in attempts, more than 300 of them successful.