Friday, 23 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Illustration: a dark server room with a lattice of glowing network nodes, one cluster highlighted in red as compromised, with circuit-trace trails converging on it

ARTEX: The AI Pentesting Tool Used in the ConnectWise Hack

by

In brief

  • On October 21, 2026, Microsoft said a China-state aligned group it tracks as Storm-0940 used an AI-driven penetration testing tool to compromise IT services firm ConnectWise — then used that foothold to target hundreds of organizations worldwide.
  • The tool is ARTEX: an open-source, multi-agent AI framework, written in Go, that runs an entire penetration test — reconnaissance to data exfiltration — with little human interaction. It works with any AI model.
  • The numbers Microsoft published: more than 2,250 Microsoft 365 tenants reached, sign-in attempts peaking at 2,900 per minute, and multiple cases where the time from first targeting to privileged access was under three hours.
  • ConnectWise says a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup, and that containing its own systems does not remove unauthorized access attackers may have established inside customer tenants.
  • If you use ConnectWise, Microsoft’s guidance is: keep affected application connections disabled until ConnectWise issues formal restoration instructions, and review your tenant for added credentials, new app consents, and privilege changes going back to October 1.

Last verified: October 22, 2026.

What happened, in order

The story has three acts, and Microsoft laid them out with unusual precision on October 21.

Act one: the spray. Between October 10 and 14, infrastructure at a single IP address (144.172.64[.]99) ran an automated cross-tenant password-spraying campaign: more than 151,000 failed logon events against 327 accounts across eight organizations, targeting Microsoft 365 and Exchange Online. Activity peaked on October 11 at 2,900 failures per minute. Microsoft says that particular campaign produced no successful authentication — but the infrastructure range would matter days later.

Act two: the supply-chain compromise. ConnectWise published an initial advisory on October 16 disclosing unauthorized access associated with its Cloud Backup environment. Microsoft now assesses that Storm-0940 — active since 2021, with no known industry aliases — was behind it, and that the attackers stole the identities of multiple ConnectWise cloud applications. On October 15, public reports of the ConnectWise compromise began surfacing with indicators matching the same network range used in the earlier spray. ConnectWise’s own advisory later shared an indicator matching exactly the 144.172.64[.]99 address from the spray campaign.

Act three: the machine-speed follow-on. With trusted ConnectWise app identities in hand, the attackers’ AI agents authenticated into customer environments — no interactive user sign-in required, because the applications had already been granted access. Microsoft observed the agents progressing through Microsoft Graph: reconnaissance, application credential modifications to establish persistence, and changes to identities, groups, and privileged roles. More than 2,250 tenants were reached at up to 2,900 sign-in attempts per minute. In several environments, the attackers went from first targeting an organization to holding privileged access to its cloud infrastructure in under three hours.

The majority of the targeting was not successful, Microsoft says. But the group “achieved privileged cloud persistence at many organizations in a brief time.” The affected sectors read like a list of everything a state-aligned data-theft group would want: aerospace and defense, energy, financial services, government, legal, semiconductors, media, military, software, technology, think tanks, and nonprofits.

What ARTEX actually is

ARTEX is not malware in the conventional sense. It is an open-source penetration testing framework — a legitimate category of tool that security teams use to test their own defenses. What makes it different is the architecture: ARTEX is a multi-agent system of LLM-driven agents, written in Go with a Next.js frontend, that can use any AI model to automate offensive security workflows. The agents run an autonomous penetration test from reconnaissance through data exfiltration with little human interaction, accumulating discovered assets and vulnerabilities into a graph as they go. The interface defaults to English and can be switched to Korean, Mandarin, Spanish, or Japanese.

That last detail is worth sitting with. The tool is public, documented, and downloadable. Microsoft says ARTEX was first tied to real-world attacks in October 2026 public reporting about breaches at South Korean financial institutions, and that it has now identified threat actors in multiple geographic regions using it. The line between a defender’s automation tool and an attacker’s force multiplier is not a technical line anymore — it is whoever runs it first.

Storm-0940’s innovation was not inventing a new technique. Password spraying, OAuth application abuse, and persistence through added credentials are the group’s established playbook from years of data-theft operations. ARTEX turned that playbook into machine-speed operations: the agents work around the clock, attempt many breach paths simultaneously, and compress what took human operators days into hours. Microsoft’s phrasing is blunt: the speed “allows very little time for Defenders to respond to those alerts and remediate the actor’s access in a coordinated fashion.”

This is the same arc this publication has been tracking. In our coverage of the NorForge report, AI agents acting on behalf of the CyberCartel group automated intrusions across more than a hundred sites. The AI-discovered PHP vulnerabilities showed AI compressing the find-to-exploit window. The Rapid7 Q3 threat report measured the disclosure-to-exploitation window at an average of three days. ARTEX is that trend arriving at the supply-chain layer: AI agents did not just find a bug or hack a website — they operated a nation-state intrusion campaign.

What this means for you

Not everyone reading this runs a Microsoft 365 tenant. But the decision tree is straightforward:

  • If your organization uses ConnectWise (especially Cloud Backup): Microsoft’s guidance is explicit — keep affected ConnectWise application connections disabled until ConnectWise provides formal restoration instructions. Do not delete the enterprise applications as a first response; preserve configuration and evidence first. Inventory the four application IDs in Microsoft’s profile and record the local service-principal object ID in each tenant. Review every Microsoft 365 tenant where the affected apps are or were authorized — search by application ID, not display name. Review activity from at least October 15, and extend service-principal sign-in review back to October 1. Look for added application credentials, new app consents, privilege and role changes. ConnectWise’s CEO warned that the company’s containment “does not remove unauthorized access that may have already been established within individual customer tenants, which require separate review.”
  • If you are an IT admin anywhere: the defensive lesson is about trusted third-party applications with high-privilege grants. Review which multi-tenant applications hold privileged permissions in your environment and apply least privilege to those grants. Monitor for credential additions, privilege assignments, and anomalous app-only activity — especially activity that does not require an interactive sign-in.
  • If you use a managed IT provider: ask them whether ConnectWise products are in their stack and whether they have completed Microsoft’s recommended review. This is a reasonable question to ask this week, not next quarter.
  • If you build or buy AI-agent tooling: ARTEX is the defender-side mirror of the monitor-tampering problem OpenAI disclosed this week. Agents operating at machine speed inside trusted identity material are exactly the scenario where enforcement must live at a layer the agent cannot rewrite — the architectural argument we covered in the CrowdStrike and NVIDIA announcement and the ThreatLocker analysis.

The question nobody has answered yet

ARTEX is open source. That means the tool Storm-0940 used is, right now, available to every other group on the planet — and to every defender. Microsoft’s blog notes, almost in passing, that when this activity is automated with AI it “generates a large volume of traffic and log data that may generate alerts” — but the speed leaves defenders almost no time to act on them. Detection without response time is just a faster way to watch yourself get breached.

The honest policy question is the dual-use one: there is no technical difference between ARTEX in a red team’s hands and ARTEX in Storm-0940’s hands. The security community has managed this tension with exploit frameworks for decades, but those frameworks needed human operators. ARTEX does not. When the operator is optional, the proliferation question changes shape — and this week’s campaign is the first large-scale demonstration of what that shape looks like.

Disclosure: this article covers a developing incident. Figures and guidance are as published by Microsoft and ConnectWise on October 21 and 16, 2026, respectively, and were last verified October 22, 2026.

Sources

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment