Microsoft pins ConnectWise breach on China-aligned group using AI agents

According to Microsoft Threat Intelligence, Storm-0940 has been active since 2021 and focuses on data theft; it has used ARTEX against hundreds of organisations worldwide since September 2026. The Record reported on 22 October that Microsoft made the attribution by matching IP addresses published by ConnectWise with those in its own investigations. In some cases the group went from initial targeting to privileged cloud access in under 3 hours. It entered customer environments under the identities of 4 pre-authorised ConnectWise applications, with no user sign-in required.

ARTEX is a multi-agent framework that runs a penetration test from reconnaissance to data exfiltration with little human input. Its interface can switch from English into 4 languages: Korean, Mandarin, Spanish and Japanese. According to The Record, the tool was published on GitHub in 2026, and on 8 October its developer wrote that it was being abused and took the project closed-source. It had previously been linked to attacks on financial institutions in South Korea and Japan. Microsoft's 21 October note stresses that several actors in different regions use ARTEX; an ARTEX trace on its own does not amount to attribution to Storm-0940.

A password-spraying wave on 10–14 October targeted 327 accounts at 8 organisations and generated more than 151,000 failed sign-ins, including over 111,000 failures on 11 October alone. Microsoft found no successful authentication in that wave, but confirmed persistence activity in several customer environments. The target list of 14 sectors includes aerospace and defence, energy, finance, government and semiconductors. According to Reuters, Chinese foreign ministry spokesperson Mao Ning said on 22 October she was not aware of the incidents.