What happened
Microsoft has identified that a China-state aligned threat actor, Storm-0940, is leveraging an open-source agentic AI penetration testing framework called ARTEX to automate and scale cyberattacks. The actor used this framework to facilitate a supply chain compromise involving ConnectWise cloud applications. By deploying AI agents, the attacker accelerated reconnaissance, password spraying, and OAuth application abuse, enabling them to authenticate to customer environments at machine speed—reaching rates of 2,900 sign-in attempts per minute. In several instances, the time from initial targeting to obtaining privileged access to cloud infrastructure was less than three hours.
Microsoft reports that Storm-0940, an actor active since 2021, began using the ARTEX framework as early as September 2026. ARTEX is a multi-agent LLM system designed to automate the entire penetration testing lifecycle, from initial reconnaissance to data exfiltration, with minimal human intervention.
During the ConnectWise compromise, the actor utilized ARTEX to abuse stolen application credentials, allowing them to authenticate to customer environments without requiring interactive user sign-ins. This bypassed traditional security measures by leveraging the trust already established between the compromised third-party application and the victim's tenant.
Once inside, the AI agents performed follow-on actions, including reconnaissance via Microsoft Graph, credential modifications, and privilege escalation. These actions were designed to establish persistent access that could survive the remediation of the original compromised application.
Microsoft clarified that this activity did not stem from a vulnerability in Microsoft’s own products or services, but rather from the abuse of legitimate application access and credentials.
Source details: microsoft.com ↗
Why it matters
The integration of agentic AI into offensive security workflows represents a significant shift in the speed and scale of cyber threats. Unlike human operators, AI agents can function continuously, executing complex, multi-stage attacks simultaneously across numerous targets. This automation compresses the window for defensive response, as the sheer volume of traffic and rapid authentication attempts can overwhelm traditional monitoring systems. The ability of these agents to perform follow-on activities, such as modifying application credentials to establish persistent backdoors, demonstrates how AI can be used to maintain long-term access even after initial entry points are remediated. This development highlights the urgent need for organizations to monitor service principal activity and audit third-party application permissions more rigorously.
The use of AI agents allows threat actors to bypass human limitations, such as the need for rest or the time required to manually analyze target environments. By automating the 'kill chain,' attackers can attempt multiple breach paths in parallel.
The speed of these attacks—specifically the ability to move from target selection to privileged access in under three hours—leaves security teams with almost no time to detect and block the activity before it reaches a critical stage.
The incident underscores the risks associated with third-party applications that hold high-level permissions within cloud environments. When these applications are compromised, the 'trust' they hold becomes a weapon for the attacker.
The ability of AI agents to modify directory roles and group memberships means that attackers can create 'backdoors' that persist even after the initial entry vector is closed, complicating incident response and recovery efforts.
Interactive Mechanism: How It Actually Works
Explore the underlying technology behind this development interactively.
crm_get_transaction(id='4092').An agent must create a draft calendar event for Tuesday at 2 p.m. Which evidence would establish the requested result?
What to watch next
Organizations should prioritize auditing their Microsoft 365 and Entra ID environments for suspicious service principal sign-ins and unauthorized modifications to OAuth application credentials. Microsoft recommends that customers review ConnectWise’s specific containment guidance and utilize provided hunting queries in Microsoft Defender XDR to identify potential indicators of compromise. It remains unknown how many specific organizations have been successfully breached beyond the initial ConnectWise supply chain incident, and the full extent of data exfiltration resulting from these AI-accelerated attacks is still being investigated.
Defenders should focus on monitoring service principal sign-in logs for unusual source IP addresses and geographic anomalies, particularly those associated with known malicious infrastructure.
Organizations are advised to use Microsoft’s provided hunting queries to correlate service principal authentication with subsequent Microsoft Graph API activity, which is a key indicator of post-compromise behavior.
It is critical to evaluate the permissions granted to all third-party applications. If an application does not require broad access to Microsoft Graph or directory operations, those permissions should be restricted or revoked.
The long-term impact of these AI-driven campaigns is still unfolding. Security teams should remain vigilant for 'dormant' persistence mechanisms, such as modified application credentials, that may have been established during the initial phase of the attack.