China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

What it is

Storm-0940 is a China-linked APT, active since at least 2021, known for password spraying and exploiting vulnerable internet-facing applications. Microsoft reports it has used the open source AI pentest framework Artex to automate attacks since early September 2026. Earlier reporting from CrowdStrike, Zscaler and Recorded Future tied this activity to attacks on South Korean financial institutions. In mid-October 2026 the actor aimed Artex at ConnectWise customers. ConnectWise suspended Cloud Backup, SaaS Security and Cloud Management in response.

How it works

Huntress saw the attackers use compromised ConnectWise application credentials to reach hundreds of Microsoft 365 tenants, including over 300 Entra tenants. Microsoft saw successful authentication to customer environments using the identities of several ConnectWise cloud applications. It also recorded more than 151,000 failed logon events.

In some environments the AI agents went past authentication into Microsoft Graph and directory operations. These included reconnaissance, application credential modifications for persistence, and changes to identities, groups and privileged roles. Microsoft says OAuth application abuse is normal for this actor, but Artex moved it to machine speed.

Preconditions / Affected

Customers of ConnectWise cloud applications that had access to their Microsoft 365 or Entra tenants. Beyond that campaign, Microsoft lists targeting since September across aerospace, automotive, chemicals, defense, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software and technology, plus non-profits and think tanks.

What to do

Microsoft advises examining service principal sign-ins alongside later Microsoft Graph activity, directory changes and resource access. Correlate suspicious events with authorized administrative activity. The page gives no queries or commands.

Application credential changes keep access alive after the affected application is remediated. Remediation should therefore include checking the application's credentials, not only fixing the original compromise.

Caveats

Zscaler has published a technical deep-dive covering Artex configurations, synchronization scripts, a Claude Code prompt history and network routing tools. This page only points to it. The page gives no indicators of compromise and does not say how the ConnectWise application credentials were first obtained.