Microsoft says China-linked hackers used AI penetration testing tool ARTEX to compromise ConnectWise as part of a campaign targeting hundreds of organizations

Automated AI penetration tools like ARTEX can now compromise cloud infrastructure in hours, bypassing traditional defenses. This accelerates threat actor speed and impact, making rapid response critical.

As early as September 2026, a China-state aligned hacking group, Storm-0940, utilized an AI-powered penetration testing tool named ARTEX to conduct large-scale, automated attacks against hundreds of organizations globally. This campaign targeted a wide array of industries, including aerospace, defense, finance, and technology. The tool, ARTEX, enables autonomous security testing workflows, allowing threat actors to automate tasks from reconnaissance to data exfiltration with minimal human intervention. Storm-0940 leveraged ARTEX to accelerate reconnaissance, password spraying, and OAuth application abuse, significantly reducing the time from initial targeting to gaining privileged access to cloud infrastructure to under three hours in some cases. Microsoft assesses that Storm-0940's use of ARTEX was behind the recent ConnectWise supply chain compromise, where the tool was employed to attempt sign-ins to thousands of tenants at a rate of 2,900 attempts per minute. The activity exploited existing OAuth application permissions to authenticate to Microsoft 365 environments without requiring interactive user sign-ins, and involved AI-accelerated follow-on activity through Microsoft Graph for reconnaissance and privilege modification.

The integration of agentic AI tools like ARTEX into offensive security workflows marks a significant escalation in the speed and scale of cyberattacks. By removing human constraints, these AI agents can operate continuously and attempt multiple breach paths simultaneously, drastically reducing the timeline for attackers to achieve objectives. This development poses a considerable challenge for defenders, as the rapid pace of automated attacks leaves minimal time for detection and remediation.

This campaign highlights a critical shift in threat actor capabilities, demonstrating how AI can be weaponized to automate complex supply chain compromises and exploit existing vulnerabilities at machine speed. Organizations leveraging cloud infrastructure and third-party applications are now at increased risk from highly sophisticated, rapidly executed attacks that are difficult to detect and respond to with traditional security measures.