China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

Storm-0940, a China-linked APT active since at least 2021, has leveraged the AI pentesting framework Artex to automate and accelerate attacks against ConnectWise customers starting in early September 2026. The group used Artex to conduct rapid reconnaissance, password spraying, and OAuth application abuse, resulting in unauthorized access to over 300 Microsoft 365 tenants. Attackers used compromised ConnectWise application credentials to authenticate and perform directory operations, including modifying application credentials to maintain persistence. ConnectWise responded by suspending several cloud services. The campaign targeted hundreds of organizations across diverse sectors. Microsoft and security researchers have detailed the attack methods and urged organizations to monitor service principal sign-ins and correlate suspicious directory activities with authorized administrative actions.

The threat actor gained privileged access to multiple Microsoft 365 tenants by abusing compromised ConnectWise application credentials, enabling reconnaissance, credential modifications, and persistent access. This allowed unauthorized control over identities, groups, and privileged roles within affected environments. Hundreds of organizations across critical sectors were impacted, potentially exposing sensitive data and operational capabilities. The use of AI automation significantly increased the speed and scale of the attacks, resulting in thousands of authentication attempts per minute and widespread compromise.

ConnectWise has suspended affected cloud services including Cloud Backup, SaaS Security, and Cloud Management to contain the attack. Organizations should examine service principal sign-ins and monitor Microsoft Graph activity, directory changes, and resource access for suspicious behavior. Correlating these events with authorized administrative activity is critical to detect unauthorized persistence mechanisms. Since the threat actor modified application credentials to maintain access, remediation should include resetting or revoking compromised credentials and reviewing OAuth application permissions. Follow vendor advisories from ConnectWise and Microsoft for updates and official remediation guidance.