Microsoft Links Storm-0940 to AI Attacks Hitting Over 2,250 Tenants via ARTEX

Microsoft Threat Intelligence released a report on October 21, 2026 tying the China state-aligned hacking group Storm-0940 to a campaign driven by ARTEX, an AI penetration-testing framework that reportedly enabled the group to escalate from initial access to elevated cloud privileges in under 3 hours. After running an automated reconnaissance and exploitation operation targeting 327 accounts from October 10 to 14, the threat actor exploited a ConnectWise supply chain compromise that occurred on October 15-16 and was publicly acknowledged on October 16. Through the ConnectWise breach, Storm-0940 abused OAuth application identities to launch authentication attempts at a rate of 2,900 sign-in attempts per minute, affecting more than 2,250 tenants. Released in July 2026 for legitimate security testing, ARTEX was taken closed-source in October 2026 after reported misuse, including prior links to data breaches affecting roughly 68,000 individuals at South Korean financial institutions. Microsoft advised security teams to audit third-party OAuth permissions and monitor non-human service principal sign-ins for abnormal volume bursts, noting that Storm-0940 has been active since at least 2021.