ARTEX AI at Machine Speed: How Storm-0940 Turned ConnectWise Into a Master Key for 2,250+ Targets
In October 2026, Microsoft attributed a sophisticated supply chain attack against ConnectWise's Cloud Backup application to Storm-0940, a China state-aligned threat actor active since at least 2021. The adversary deployed ARTEX, a Go-based agentic AI penetration testing framework, to automate password spraying, OAuth application abuse, and reconnaissance at machine speed—targeting over 2,250 tenants at 2,900 sign-in attempts per minute. Between October 10–14, 2026, attackers generated over 151,000 failed logon events before gaining access on October 15 by compromising ConnectWise cloud application identities, enabling authentication into customer environments without interactive user sign-in. Privileged access was achieved at several organizations within under three hours of initial targeting. This incident marks a critical inflection point in nation-state cyber operations: the weaponization of agentic AI frameworks compresses attack timelines from days to hours, renders traditional detection windows insufficient, and exploits the trust relationships inherent in managed service provider ecosystems—amplifying blast radius across hundreds of downstream organizations simultaneously.
Kill Chain
