# Microsoft says Storm-0940 used AI-driven ARTEX framework in attacks

Digest AI · Agents & Tools · published 2026-10-21T12:18:00Z · updated 2026-10-22T06:31:00Z

Canonical: https://digestai.news/story/microsoft-says-storm-0940-used-ai-driven-artex-framework-in-attacks

## Summary

Microsoft Threat Intelligence reported that the China state‑aligned hacking group Storm‑0940 leveraged ARTEX, an AI‑driven penetration‑testing framework, to automate a multi‑stage campaign. The research describes an operation from October 10‑14 that targeted 327 accounts using the tool, then moved to a ConnectWise supply‑chain compromise on October 15‑16. ConnectWise publicly acknowledged the breach on October 16.

During the ConnectWise phase, the attackers abused OAuth application identities, generating authentication attempts at a rate of 2,900 sign‑ins per minute. Microsoft linked the activity to abuse affecting more than 2,250 tenants. Earlier misuse of ARTEX was tied to data breaches that exposed roughly 68,000 individuals at South Korean financial institutions. ARTEX was released in July 2026 for legitimate security testing and was made closed‑source in October 2026 after the reported misuse.

Microsoft’s guidance advises security teams to audit third‑party apps with OAuth permissions, monitor service‑principal sign‑ins for unusual volume, and treat sudden bursts of authentication attempts as an alarm. The three‑hour breach window highlighted by the report underscores how AI‑driven tools can compress attack timelines beyond traditional defensive response times.

## Key points

- Microsoft ties Storm‑0940 to ARTEX, an AI‑driven framework used in a campaign that hit 327 accounts Oct 10‑14.
- Attackers exploited a ConnectWise supply‑chain breach, abusing OAuth app identities and firing 2,900 sign‑in attempts per minute.
- ARTEX, released July 2026 for legitimate testing, was closed‑source in October 2026 after misuse affecting over 2,250 tenants.

## Why it matters

AI‑driven attack tools can shrink breach timelines to hours, overwhelming traditional defenses and exposing the risks of dual‑use security software in multi‑tenant cloud environments.

## Sources

1. [Microsoft links Storm-0940 to AI-driven attacks using ARTEX framework](https://cryptobriefing.com/microsoft-storm-0940-artex-ai-attacks) (cryptobriefing.com, 2026-10-21)
2. [Microsoft says China-aligned hackers used AI agents in ConnectWise attack](https://thenextweb.com/news/microsoft-storm-0940-ai-agents-connectwise-attack) (thenextweb.com, 2026-10-22)
3. [Microsoft says China-linked hackers used AI penetration testing tool ARTEX to compromise ConnectWise as part of a campaign targeting hundreds of organizations](https://reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21) (reuters.com, 2026-10-22)
4. [AI-Powered hackers, 2,900 attempts a minute: Microsoft blames China-linked group for AI-assisted ConnectWise cyberattack](https://businesstoday.in/technology/news/story/ai-powered-hackers-2900-attempts-a-minute-microsoft-blames-china-linked-group-for-ai-assisted-connectwise-cyberattack-563101-2026-10-22) (businesstoday.in, 2026-10-22)
5. [Microsoft: Chinese State Actor Used AI to Compromise ConnectWise Tenants](https://infosecurity-magazine.com/news/microsoft-chinese-ai-connectwise) (infosecurity-magazine.com, 2026-10-22)
6. [China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants](https://csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html) (csoonline.com, 2026-10-21)
7. [China-Linked Hacker Used Agentic AI to Reach Cloud Privileges in Under 3 Hours, Microsoft Says](https://ibtimes.sg/china-linked-hacker-used-agentic-ai-reach-cloud-privileges-under-3-hours-microsoft-says-95385) (ibtimes.sg, 2026-10-21)
8. [Chinese-linked hackers used AI in ConnectWise breach: Microsoft](https://aa.com.tr/en/science-technology/chinese-linked-hackers-used-ai-in-connectwise-breach-microsoft/4097217) (aa.com.tr, 2026-10-21)
9. [China-Linked Hackers Use ARTEX AI Agents to Abuse ConnectWise Supply Chain Attack](https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html) (thehackernews.com, 2026-10-21)
10. [Chinese-linked hackers compromise ConnectWise, target hundreds in global attack: Microsoft](https://straitstimes.com/world/united-states/chinese-linked-hackers-compromise-connectwise-target-hundreds-in-global-attack-microsoft) (straitstimes.com, 2026-10-21)

## Cite

Digest AI, "Microsoft says Storm-0940 used AI-driven ARTEX framework in attacks", 21 October 2026, https://digestai.news/story/microsoft-says-storm-0940-used-ai-driven-artex-framework-in-attacks

---

Written by Digest AI's editorial model from the linked sources; the sources are the record. Headlines, digests and key points are written by Digest AI and may be quoted with a link to the story page. Linked articles belong to their publishers. Terms: https://digestai.news/terms#reuse
JSON: https://digestai.news/story/microsoft-says-storm-0940-used-ai-driven-artex-framework-in-attacks.json