China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

* A China-linked threat actor used the Artex framework to automate a ConnectWise hacking campaign.
* The actor is tracked as Storm-0940, active since at least 2021.
* Storm-0940 relies on password spraying and exploiting vulnerable internet-facing applications.
* Starting in early September 2026, the threat actor used Artex to automate attacks.
* Previous reporting linked this AI activity to attacks targeting South Korean financial institutions.
* Storm-0940 used Artex to automate intrusions into ConnectWise customers’ environments in mid-October.
* The actor used compromised ConnectWise application credentials to access over 300 Microsoft 365 Entra tenants.
* The attack involved attempting to sign-in to more than 2,250 tenants using Artex acceleration.
* Microsoft captured over 151,000 failed logon events and observed successful authentication using customer cloud application identities.
* AI agents progressed beyond authentication to Microsoft Graph and directory operations, including reconnaissance and credential modifications for persistence.
* The threat actor used Artex in automated attacks across various sectors including aerospace, automotive, financial services, government, and technology.

The narrative demonstrates a clear evolution of threat actor methodology, shifting from traditional manual techniques like password spraying to leveraging sophisticated AI automation via frameworks like Artex for high-velocity reconnaissance and persistence. The incorporation of LLM capabilities into penetration testing introduces an exponential increase in the speed and scope with which adversaries can map and compromise complex environments, moving beyond simple vulnerability exploitation into deep directory manipulation. The focus on service principal sign-ins and Microsoft Graph activity as a subsequent step reveals that the objective is not merely initial access, but establishing long-term, seemingly legitimate persistence within cloud identity structures, making remediation dependent not just on patching applications but on comprehensive identity governance visibility. This pattern suggests an industry-wide vulnerability where reliance on automated tools for reconnaissance amplifies the risk associated with compromised credentials and weak Identity and Access Management (IAM) controls. The potential implication is a systemic challenge to defense strategies that rely on human detection of sporadic events, forcing a pivot toward continuous, contextual analysis of identity flow across connected systems.
BRIDGE QUESTIONS:
How does the perceived acceleration of attack velocity change an organization's internal risk tolerance for cloud service principal interactions?
If attackers can automate persistence through credential changes, what new controls are necessary to distinguish legitimate administrative actions from AI-induced modifications in Microsoft Graph data?
What systemic shifts must occur in security monitoring practices to effectively correlate high-speed automated activity with low-and-slow identity drift?