---
title: Microsoft: China-aligned Storm-0940 ran ARTEX agentic AI pentests — privileged cloud access in under 3 hours; used in ConnectWise app abuse | ctxsec
url: https://ctxsec.com/items/ms-storm-0940-artex-agentic-ai
description: ""
status: "confirmed (Microsoft Threat Intelligence blog Oct 21)"
published: 2026-10-21
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/ms-storm-0940-artex-agentic-ai.md)

confirmed (Microsoft Threat Intelligence blog Oct 21)

2026-10-21

### Microsoft: China-aligned Storm-0940 ran ARTEX agentic AI pentests — privileged cloud access in under 3 hours; used in ConnectWise app abuse

Microsoft says China state-aligned **Storm-0940** (active since 2021; no common industry alias) used the open-source multi-agent pentest framework **ARTEX** (Go + Next.js; any LLM; EN/KR/ZH/ES/JA) from as early as September 2026 to automate recon through exfiltration against hundreds of orgs in aerospace, energy, finance, government, manufacturing and more. Several ARTEX-driven intrusions reached privileged cloud access in **under three hours**. MS assesses Storm-0940 was behind the ConnectWise Cloud Backup / SkyKick multi-tenant OAuth compromise, then used ARTEX to drive machine-speed app-only auth and Graph abuse (credential adds, privilege changes) across thousands of downstream tenants. The activity did not stem from a Microsoft product compromise. This is a concrete case of an agentic offensive harness compressing a supply-chain follow-on from days to minutes — defenders need app-only / service-principal monitoring that assumes non-interactive, high-rate Graph traffic. See the updated ConnectWise news item and hunt for IOCs.

Sources: [Microsoft Threat Intelligence: Storm-0940 / ARTEX](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) · [GMO Ierae ARTEX reporting (earlier ctxsec item)](https://ctxsec.com/context#gmo-ierae-artex-ai-pentest-japan-breach-wave)