AI pentesting tool Artex used in recent ConnectWise compromise
Microsoft reported that during the ConnectWise Cloud Backup compromise revealed last week that affected Microsoft environments, Chinese threat actor Storm-0940 used AI penetration-testing tool Artex to accelerate scanning and reconnaissance, password spraying and OAuth application abuse.
Microsoft reported that during the ConnectWise Cloud Backup compromise revealed last week that affected Microsoft environments, Chinese threat actor Storm-0940 used AI penetration-testing tool Artex to accelerate scanning and reconnaissance, password spraying and OAuth application abuse.
In the ConnectWise campaign, Wells said Microsoft observed activity reaching more than 2,250 cloud tenants, with more than 2,900 sign-in attempts per minute.
When service principals and OAuth apps hold persistent, high-level access without continuous monitoring, they provide a frictionless path for AI-driven lateral movement.” Anthony Pillitiere, co-founder at Horizon3, added that while the ConnectWise breach has been framed as an AI story, AI didn't break in — a poorly protected vendor secret with access to thousands of tenants did, and agentic tooling just made the damage happen faster.
That lets attackers target more organizations, test more attack paths, and exploit opportunities much faster.” Shane Barney, chief information security officer at Keeper Security, said the integration of agentic AI frameworks into nation-state cyber operations represents a fundamental shift in the speed and scale of supply chain attacks.
This is a critical vulnerability given that research from 2026 reveals more than 72% of organizations take hours, days or even weeks to detect credential misuse, Barney continued.
In several attacks, the time from initial targeting to privileged access was less than three hours.
Barney said when a threat actor can use an autonomous AI agent to automate reconnaissance, execute password sprays and abuse OAuth applications to gain privileged cloud access in under three hours, the traditional window for detection and response effectively disappears.
Now we’re seeing Artex used by a state-aligned threat actor to automate reconnaissance, credential attacks and the abuse of trusted cloud applications.
Autonomous agents thrive in environments where non-human identities are loosely governed and standing privileges are left unchecked.
21 post from Microsoft , Storm-0940 used Artex to target hundreds of Microsoft environments across multiple industries, including aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, the military, technology, and think tanks and non-profits.
What happened
Microsoft reported that during the ConnectWise Cloud Backup compromise revealed last week that affected Microsoft environments, Chinese threat actor Storm-0940 used AI penetration-testing tool Artex to accelerate scanning and reconnaissance, password spraying and OAuth application abuse.
In the ConnectWise campaign, Wells said Microsoft observed activity reaching more than 2,250 cloud tenants, with more than 2,900 sign-in attempts per minute.
What changed
When service principals and OAuth apps hold persistent, high-level access without continuous monitoring, they provide a frictionless path for AI-driven lateral movement.” Anthony Pillitiere, co-founder at Horizon3, added that while the ConnectWise breach has been framed as an AI story, AI didn't break in — a poorly protected vendor secret with access to thousands of tenants did, and agentic tooling just made the damage happen faster.
Who is affected
That lets attackers target more organizations, test more attack paths, and exploit opportunities much faster.” Shane Barney, chief information security officer at Keeper Security, said the integration of agentic AI frameworks into nation-state cyber operations represents a fundamental shift in the speed and scale of supply chain attacks.
This is a critical vulnerability given that research from 2026 reveals more than 72% of organizations take hours, days or even weeks to detect credential misuse, Barney continued.
Why it matters
In several attacks, the time from initial targeting to privileged access was less than three hours.
Barney said when a threat actor can use an autonomous AI agent to automate reconnaissance, execute password sprays and abuse OAuth applications to gain privileged cloud access in under three hours, the traditional window for detection and response effectively disappears.
Technical details
Now we’re seeing Artex used by a state-aligned threat actor to automate reconnaissance, credential attacks and the abuse of trusted cloud applications.
Autonomous agents thrive in environments where non-human identities are loosely governed and standing privileges are left unchecked.
Attribution
SC Media: Microsoft reported that during the ConnectWise Cloud Backup compromise revealed last week that affected Microsoft environments, Chinese threat actor Storm-0940 used AI penetration-testing tool Artex to accelerate scanning and reconnaissance, password spraying and OAuth application abuse.