BreakingCyber Security
Nation-state actor uses agentic AI framework ARTEX to automate ConnectWise supply chain attack
Microsoft reports that Storm-0940, a China-state aligned threat actor active since 2021, began using the open-source agentic AI penetration testing framework ARTEX in September 2026 to automate attacks against hundreds of organizations worldwide. Microsoft assesses the actor was behind the recently disclosed ConnectWise supply chain compromise, in which ARTEX-driven password spraying and OAuth application abuse reached over 2,250 downstream tenants at up to 2,900 sign-in attempts per minute. In several cases the actor obtained privileged cloud access in under 3 hours, and follow-on activity included credential and privilege changes aimed at persistence.