China-Linked Hackers Exploit AI-Powered ARTEX Framework in Massive Microsoft 365 Targeting Spree
A China-state-aligned threat actor, tracked as Storm-0940, leveraged ARTEX an AI-driven penetration-testing framework to orchestrate a large-scale campaign targeting over 2,250 Microsoft 365 tenants following the ConnectWise Cloud Backup breach. Microsoft reported 2,900 sign-in attempts per minute, overwhelming security teams and leaving minimal time for intervention.
The attackers abused stolen application credentials and pre-approved customer permissions, bypassing the need for interactive user logins. Between October 10 and 14, Storm-0940’s infrastructure targeted 327 accounts across eight organizations, generating 151,000 failed logon attempts though no successful authentications were observed during this phase. However, earlier reporting confirmed unauthorized access to 173 tenants, with Microsoft noting that successful sign-ins did not necessarily equate to data exfiltration.
ARTEX, a legitimate security-testing tool, was repurposed for scanning, password spraying, and OAuth abuse, enabling rapid reconnaissance and privilege escalation. Microsoft observed that some attacks achieved privileged cloud access in under three hours, with threat actors modifying application credentials and roles to maintain persistence even after the original ConnectWise connection was disabled.
A parallel investigation by Zscaler revealed that a Chinese-speaking operator integrated ARTEX with AI models like Claude Code, Codex, DeepSeek, GLM, and Grok, automating tasks such as vulnerability scanning, SQL injection testing, and mobile app analysis. The framework’s modular design allowed attackers to resume interrupted sessions, synchronize findings, and extract sensitive data including personal records, payment credentials, and transaction details though no evidence confirmed the sale of stolen information.
Microsoft attributed the attack to Storm-0940, while Zscaler’s findings suggested broader targeting across multiple countries and sectors, expanding on prior ARTEX-linked breaches in South Korean financial institutions. The campaign exploited Microsoft Graph API to inspect environments, alter credentials, and manipulate identities, groups, and roles actions that could preserve access through secondary applications.
Defensive measures recommended by Microsoft include disabling affected ConnectWise connections, preserving forensic evidence, and scrutinizing service-principal sign-ins, consent grants, and unusual Graph activity. The attack did not stem from a vulnerability in Microsoft’s systems but relied on stolen credentials and misconfigured permissions.
Indicators of compromise (IoCs) include:
- Microsoft-flagged IPs:
144.172.64[.]128,144.172.64[.]99,144.172.64[.]60(sign-ins/Graph activity) - VPN IPs:
187.15.88[.]186,187.15.90[.]217(time-limited investigations) - Zscaler IPs:
23.248.226.250-254(work servers),38.244.50.120(jump server) - User agents:
Python-urllib/3.12,python-requests/2.31.0,curl/7.88.1 - Compromised application IDs:
506e08f9-6e9a-4da4-942b-a099a03644ae(ConnectWise Cloud Backup),24205314-2b89-4e07-a2a4-579e898a5640(ConnectWise MS Teams)Source: https://cybersecuritynews.com/china-linked-hackers-use-artex-ai/
ConnectWise cybersecurity rating report: https://www.rankiteo.com/company/connectwise
"id": "CON1792650423",
"linkid": "connectwise",
"type": "Breach",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': '173 tenants accessed (potential '
'data exposure)',
'industry': ['Multiple Sectors'],
'location': ['Global', 'South Korea (prior breaches)'],
'name': 'Microsoft 365 Tenants',
'size': 'Over 2,250 tenants targeted',
'type': 'Cloud Service'},
{'industry': 'IT Management',
'name': 'ConnectWise',
'type': 'Software Provider'}],
'attack_vector': ['Stolen Application Credentials',
'Pre-Approved Permissions',
'Microsoft Graph API Abuse'],
'data_breach': {'data_exfiltration': 'Potential (no evidence of sale)',
'personally_identifiable_information': 'Yes',
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Records',
'Payment Credentials',
'Transaction Details']},
'date_detected': '2023-10-10',
'description': 'A China-state-aligned threat actor, tracked as Storm-0940, '
'leveraged ARTEX, an AI-driven penetration-testing framework, '
'to orchestrate a large-scale campaign targeting over 2,250 '
'Microsoft 365 tenants following the ConnectWise Cloud Backup '
'breach. The attackers abused stolen application credentials '
'and pre-approved customer permissions, bypassing interactive '
'user logins. The campaign exploited Microsoft Graph API to '
'inspect environments, alter credentials, and manipulate '
'identities, groups, and roles.',
'impact': {'data_compromised': ['Personal Records',
'Payment Credentials',
'Transaction Details'],
'identity_theft_risk': 'High',
'operational_impact': 'Overwhelmed security teams with 2,900 '
'sign-in attempts per minute',
'payment_information_risk': 'High',
'systems_affected': ['Microsoft 365 Tenants']},
'initial_access_broker': {'backdoors_established': 'Modification of '
'application credentials '
'and roles for persistence',
'data_sold_on_dark_web': 'No evidence confirmed',
'entry_point': 'Stolen ConnectWise Cloud Backup '
'credentials'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Attackers can achieve privileged cloud access in under '
'three hours using stolen credentials and misconfigured '
'permissions. AI-driven tools like ARTEX can automate and '
'accelerate attack campaigns.',
'motivation': ['Espionage', 'Data Theft'],
'post_incident_analysis': {'corrective_actions': ['Enhanced monitoring of '
'Graph API activity',
'Restricting application '
'permissions',
'Disabling compromised '
'connections'],
'root_causes': ['Stolen application credentials',
'Misconfigured permissions',
'Abuse of pre-approved customer '
'permissions']},
'recommendations': ['Disable affected ConnectWise connections',
'Preserve forensic evidence',
'Scrutinize service-principal sign-ins and consent grants',
'Monitor unusual Graph API activity',
'Review and restrict application permissions'],
'references': [{'source': 'Microsoft'}, {'source': 'Zscaler'}],
'response': {'containment_measures': ['Disabling affected ConnectWise '
'connections',
'Preserving forensic evidence'],
'enhanced_monitoring': 'Recommended',
'remediation_measures': ['Scrutinizing service-principal '
'sign-ins',
'Reviewing consent grants',
'Monitoring unusual Graph activity'],
'third_party_assistance': ['Microsoft', 'Zscaler']},
'threat_actor': 'Storm-0940 (China-state-aligned)',
'title': 'China-Linked Hackers Exploit AI-Powered ARTEX Framework in Massive '
'Microsoft 365 Targeting Spree',
'type': ['Credential Abuse', 'OAuth Abuse', 'AI-Powered Attack'],
'vulnerability_exploited': ['Misconfigured Permissions',
'ConnectWise Cloud Backup Breach']}