Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents

A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise hundreds of other organizations around the globe, Microsoft said Wednesday. 

Microsoft has been investigating a string of attacks conducted by a threat actor they call Storm-0940, which has used an AI penetration testing framework called ARTEX to breach organizations’ cloud infrastructure. 

Since September, the group has been able to breach a wide variety of organizations across government, aerospace, defense, finance, manufacturing, technology and energy industries. 

After gaining access to the companies, the hackers conducted reconnaissance, acquired credentials and tried to expand their privileges for expanded data collection.

Microsoft said the campaign stands out because of how AI has accelerated the hackers’ ability to quickly breach targets. In multiple instances it took the threat actors less than three hours from the initial targeting to gain privileged access. 

“While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time,” Microsoft said.

Storm-0940 has been active since 2021, according to Microsoft, and typically conducts attacks for data theft purposes. It targets internet-facing applications and uses compromised accounts to expand access. 

ARTEX is a penetration testing tool that allows users to deploy any AI model to automate offensive security actions. The platform coordinates a team of agents that can “run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction,” Microsoft explained. 

It was released on GitHub earlier this year as an open-source tool by an account known as "Autumn-27.” 

The tool was recently implicated in multiple attacks on South Korean and Japanese financial institutions. 

Researchers at Zscaler released a report on Wednesday saying the ARTEX-backed attacks went far beyond South Korea and targeted dozens of industries across multiple countries. 

The developer of the framework — identified as Chinese cybersecurity engineer Li Puhua — released a statement on GitHub on October 8 saying the tool was abused by malicious actors.

“ARTEX was originally designed for learning and research purposes, aiming to help enterprises and organizations conduct security risk testing within their authorized assets and improve their security capabilities,” the developer wrote in a machine translated message, denying any responsibility for crimes committed with it.  

“Given the misuse of the tool, the ARTEX project will no longer be updated and will be converted to closed source. No further versions or maintenance support will be released to the public.”

Chinese Foreign Ministry spokesperson Mao Ning denied any knowledge of the incidents during a recent press briefing, according to Reuters. 

2,900 sign-in attempts per minute

Over the weekend, ConnectWise was forced to shut down several of its services after Microsoft and other cybersecurity companies warned of a supply-chain attack impacting Cloud Backup. 

The service is designed to help protect data in Microsoft 365 and Google Workspace. Attackers used stolen Cloud Backup credentials to gain wide access to any systems where the app is installed.

According to Microsoft, Storm-0940 used ARTEX to accelerate the “speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access.”

“This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,” Microsoft said.  

“Agents are not constrained by factors affecting humans — they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises.”

Microsoft said the ConnectWise incident involved 2,900 sign-in attempts per minute — a pace that leaves no time for human defenders to detect and respond. There were more than 111,000 failed log-on attempts on October 11 alone. 

“The campaign blended broad, low-rate account spraying with sustained, high-volume authentication attempts against selected identities; 48 accounts received more than 1,000 failures, and lockout responses represented nearly 98% of all activity,” Microsoft said. 

Microsoft said it was able to tie the campaign to Storm-0940 based on publicly reported IP addresses from ConnectWise that matched those seen in their own investigations.