Storm-0940 ARTEX attack on Microsoft 365

The Chinese embassy dismissed Microsoft's attribution of the ARTEX-driven ConnectWise attack as 'smears,' and ConnectWise's CEO said the attack 'appears' to be the work of such a group, adding qualified official responses to a disclosure Microsoft published on October 21, 2026. Microsoft Security linked China-state aligned threat actor Storm-0940 to an attack that used an open-source AI agent called ARTEX to abuse OAuth applications compromised via ConnectWise, reaching over 2,250 Microsoft 365 tenants at 2,900 sign-in attempts per minute. The entry point was a supply chain compromise: on October 16, 2026, ConnectWise reported unauthorized access to customer tenants through multiple OAuth application identities that held broad pre-authorized access to Microsoft 365 environments. Storm-0940 used those OAuth grants to authenticate without interactive user sign-in, bypassing MFA. ARTEX, released on GitHub as open source, chains LLM agents through reconnaissance, credential abuse, and data theft with minimal human involvement. Several intrusions progressed from first targeting to privileged cloud access in under three hours. Inside compromised tenants, agents queried Microsoft Graph, added credentials to applications, and in some cases had a ConnectWise app grant itself Global Administrator privileges. Most targeting attempts failed; one password spray logged over 151,000 failures without a single success. Storm-0940 has targeted multiple industries for data theft and has been active since at least 2021.