Storm-0940 is a China-aligned threat actor active since 2021. It used the ARTEX agentic AI framework to automate attacks on hundreds of organizations. Targets spanned aerospace, automotive, energy, financial services, government, and others. The ConnectWise supply chain compromise was one such attack. Storm-0940 gained privileged cloud access in under three hours in multiple cases. ARTEX enabled round-the-clock, multi-path breaches without human limits. It accelerated application credential abuse in Microsoft 365 environments. Follow-on activity included Microsoft Graph reconnaissance and privilege changes. Microsoft observed no compromise of its own systems or services. ARTEX is an open-source, multi-agent LLM penetration testing framework. It supports English, Korean, Mandarin, Spanish, and Japanese. ConnectWise disclosed the incident on October 16, 2026. Storm-0940 attempted sign-ins to over 2,250 tenants after the breach.
What changed
Storm-0940 relied on manual password spraying and OAuth application abuse without AI automation.
What it unlocks
Automating reconnaissance, password spraying, and OAuth abuse at machine speed across many targets simultaneously.
- 2,250+ tenant sign-in attempts
- less than 3 hours from targeting to privileged access
- hundreds of organizations targeted globally
What you need to act on it
- ARTEX framework access
- compromised ConnectWise application credentials
Sources