AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

Storm-0940 is a China-state aligned actor active since 2021, targeting diverse industries for data theft. Starting September 2026, the actor integrated the agentic AI penetration testing framework ARTEX to automate and scale offensive operations globally. ARTEX, an open-source multi-agent LLM system, automates penetration testing workflows from reconnaissance to data exfiltration with minimal human input. Using ARTEX, Storm-0940 accelerated attack phases including scanning, password spraying, and OAuth application abuse, enabling rapid privileged access to cloud environments. The actor exploited compromised OAuth applications to authenticate to Microsoft 365 environments without interactive sign-in, conducting follow-on activities such as reconnaissance, credential changes, and privilege modifications via Microsoft Graph. This campaign included the ConnectWise supply chain compromise affecting multi-tenant applications. Microsoft confirmed no compromise of its own corporate systems or products. Microsoft Defender XDR offers detection capabilities for this threat, and customers should monitor for suspicious Microsoft Graph activity and application credential changes.

The threat actor gained privileged access to multiple organizations' cloud infrastructures, enabling potential persistent access and data exfiltration. The use of AI automation significantly reduced the time from targeting to compromise, increasing the speed and scale of attacks. The ConnectWise supply chain compromise illustrates the risk of downstream impacts from such supply chain attacks. Although Microsoft detected authentication and follow-on activities in affected environments, the presence of these activities does not necessarily confirm data access or exfiltration. The rapid and automated nature of the attacks challenges defenders' ability to respond effectively before the actor establishes persistence.

Microsoft Defender XDR provides detections and hunting queries for suspicious Microsoft Graph activity and known threat infrastructure associated with Storm-0940. Customers should review service principal sign-ins, investigate unexpected application credential or privilege changes, and follow ConnectWise’s published containment guidance. Preserving relevant evidence for investigation is recommended. Since the activity did not result from vulnerabilities in Microsoft products or services, remediation focuses on detection, investigation, and containment of compromised credentials and OAuth applications. No official patch is applicable as this is an adversary campaign leveraging existing access and automation tools.