A China-aligned hacking group used ARTEX AI agents to turn stolen ConnectWise credentials into access to more than 2,250 customer cloud tenants, according to a report Microsoft published on 21 October. The company says the agents ran reconnaissance, password spraying and privilege changes at a pace no human team could match, and in some cases reached privileged cloud access in under three hours.
Microsoft's threat intelligence unit attributes the campaign to a group it tracks as Storm-0940, which it describes as China-state-aligned and active since 2021. The incident is one of the clearest public cases so far of an open-source agent framework being used end to end in a nation-state intrusion, and it lands while regulators in Brussels, London and Washington are still deciding who should answer for what AI agents do.
What Microsoft says ARTEX AI agents did
ARTEX is an open-source penetration testing framework that can be connected to any AI model. Microsoft describes it as a multi-agent system written in Go with a web front end. It can run a test from reconnaissance through to data exfiltration with little human input, and its agents build a map of the assets and weaknesses they find as they go. The interface defaults to English and can be switched to Korean, Mandarin, Spanish or Japanese.
According to Microsoft, Storm-0940 began using ARTEX as early as September 2026. The sequence it lays out runs like this:
- 10 to 14 October: infrastructure at a single IP address ran a password-spray campaign against 327 accounts at eight organisations, logging more than 151,000 failed sign-ins. Activity peaked on 11 October at 2,900 failures a minute. Microsoft says none of those spray attempts succeeded.
- The supply chain step: the group broke into ConnectWise's cloud backup service and took application credentials that link ConnectWise to its corporate customers' Microsoft environments.
- 15 and 16 October: security firm Huntress reported the ConnectWise compromise publicly, and ConnectWise issued its first advisory.
- After access: using those app credentials, the agents signed in to customer tenants without any user logging in, then queried Microsoft Graph, changed application credentials to keep access, and tried to alter users, groups and admin roles. In some tenants an application gave itself the Global Administrator role. Secrets were read from multiple Key Vaults.
Microsoft says the targets spanned aerospace and defence, energy, financial services, government and semiconductors, and that most attempts failed. TechCrunch, which first reported the scale on 22 October, noted that ConnectWise paused its cloud backup service while it investigates.
Why the speed matters
"Agents are not constrained by factors affecting humans," Microsoft wrote, adding that the campaign moved "at a pace that leaves defenders with little time to detect and respond." The CrowdStrike research team has separately reported ARTEX being used against South Korean financial institutions this month, which suggests the tool is spreading among more than one group.
The governance questions this raises
For policymakers, three points stand out.
Open-source dual use. ARTEX was built for legitimate security testing. Its use by a state-aligned group revives a debate that has run through the EU AI Act's general-purpose model rules and the US export control discussion: whether openly published agent tooling should carry any release obligations. China's own draft list of AI technologies for export control, published on 16 October, shows that governments on every side are now treating capability as something to manage.
Third-party access. The breach did not need a flaw in Microsoft's software. It used credentials that customers had granted to a trusted vendor. Supply-chain rules such as the EU's NIS2 directive and the UK's Cyber Security and Resilience Bill already ask firms to manage supplier risk, but few frameworks address multi-tenant app permissions held by a single provider across thousands of clients.
Liability for agents. US senators Josh Hawley and Chris Murphy proposed an AI Agent Accountability Act earlier this month that would make operators and developers liable when their advanced models hack into other systems. Cases like this one, where a third party picks up a public tool and points it at victims, show how hard it is to draw that line between the builder, the model provider and the attacker.
We covered an earlier example of cheap agent-driven attacks in our report on one actor who hit more than 100 sites for about $50 each. The ConnectWise case is larger and better documented.
What organisations should do now
Microsoft's guidance is specific. If your organisation used ConnectWise cloud backup or its Microsoft 365 integrations, the company recommends:
- Keep the affected ConnectWise application connections disabled until ConnectWise issues formal restoration instructions.
- Do not delete the enterprise applications as a first step. Preserve configuration and logs as evidence.
- Find every tenant where the affected apps were installed or authorised, searching by application ID rather than display name.
- Review sign-in and audit logs from at least 15 October, and back to 1 October where records exist. Look for new credentials, new owners, consent grants, role changes and changes to MFA or Conditional Access.
- Once evidence is kept, remove unauthorised credentials and grants, cut excess permissions and rotate secrets.
- Apply least privilege to all multi-tenant app permissions, not only ConnectWise's.
Microsoft has published indicators of compromise, including IP addresses in the 144.172.64.x range and the affected application IDs, in its report.
What happens next
ConnectWise said on Thursday that it is working to restore the service. No government agency has commented publicly on the attribution so far. Expect the incident to feature in the EU's ongoing enforcement talks with AI labs and in US Senate debate on agent liability, where it gives both sides a concrete case: one where the AI did most of the work, and the humans behind it are out of reach of any domestic law.
