Microsoft Threat Intelligence reported that the hacking group Storm-0940, linked to China, has been utilizing the AI-driven penetration-testing framework ARTEX. The group has used the tool to automate reconnaissance and exploitation phases across hundreds of organizations.
In certain incidents, the attackers managed to escalate from initial access to privileged cloud control in under three hours. One specific operation between October 10 and 14, 2026, targeted 327 accounts using the framework.
The campaign leveraged a supply chain compromise at ConnectWise on October 15-16, 2026. Attackers abused OAuth identities to execute authentication attempts at a rate of 2,900 per minute, affecting over 2,250 tenants.
ARTEX was released in July 2026 for security testing but transitioned to closed-source in October 2026 due to misuse. Prior to the ConnectWise breach, the tool was linked to data leaks impacting 68,000 individuals at South Korean financial institutions.
Microsoft advises organizations to audit third-party OAuth permissions and monitor service principal activity for unusual spikes. The company has provided indicators of compromise and Defender detections to assist in identifying similar threats.
