What happened, and when
Microsoft published its research on October 21, 2026, tying the ConnectWise compromise to Storm-0940, a group the company describes as a China-state aligned actor active since 2021. Microsoft’s blog post says the group used ARTEX as early as September 2026 to automate attacks against hundreds of organizations globally. Press coverage followed on October 22, including The Record’s report and The Register’s story.
ConnectWise published its initial advisory on October 16 and later expanded it. The Register reports the company pulled its Cloud Backup, SaaS Security and Cloud Management services after discovering unauthorized access to application identities. Microsoft assesses that Storm-0940 was responsible for the compromise of that multi-tenant application. Microsoft says the sign-in attempts reached more than 2,250 Microsoft 365 tenants, at times peaking at 2,900 attempts a minute, and it has not disclosed how many customers were actually compromised.
What ARTEX actually is
ARTEX is an open-source penetration-testing framework written in Go with a Next.js front end. Microsoft describes it as a multi-agent LLM system that can use any AI model, with agents that “run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.” It builds a graph of discovered assets and vulnerabilities, which is exactly what a legitimate red team wants and exactly what a crew of state hackers wants too.
The developer’s side of the story is murky. According to The Record, the project’s developer posted on GitHub on October 8 that the tool had been abused and would move to closed source. China’s Foreign Ministry denied any knowledge of the incidents, per Reuters as reported by The Record. We have no independent way to check either claim, so we treat them as context, not findings.
Why the pattern matters more than the tool
Nothing in this campaign is technically exotic. Password spraying, OAuth application abuse and Microsoft Graph reconnaissance have been around for years. The change is tempo. Microsoft says most of the targeting failed, but Storm-0940 still achieved privileged cloud persistence at many organizations in a brief time. In some cases, attackers went from first targeting to privileged access in under three hours. Microsoft put it plainly: “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows.” Its follow-up line is less comforting: “Agents are not constrained by factors affecting humans.”
Microsoft also notes that an affected application or a successful authentication does not necessarily mean customer data was accessed or exfiltrated. That caveat matters, and it should not become an excuse to wait.
What it means for solo operators and marketers
If your marketing stack is a dozen SaaS tools glued together with automations, your exposure lives in the connections. Every OAuth consent you clicked two years ago is a permission someone can still use. Backup and management tools often hold broad read access to mailboxes, drives and client files, which makes them attractive targets. An automation platform holding API keys is a second front door.
This week, do four things. Review OAuth app consents in Microsoft 365 and Google Workspace and revoke anything you do not recognize or no longer use. Rotate credentials for any integration that touches client data. Turn on sign-in alerts for service accounts. And if you use ConnectWise Cloud Backup, keep affected connections disabled until ConnectWise provides formal restoration instructions, which is what Microsoft recommends.
Our take
Here is our opinion, and it is not a comfortable one. The story is not “AI hackers are coming.” They arrived, and they are using a free, open-source tool that anyone can download. Nobody in this story built a clever chatbot. They built a very patient burglar, handed him a list of sign-in endpoints, and let him work the night shift.
We think the lesson for small operators is boring and correct: stop treating third-party apps as trusted by default. Your vendor’s security posture is now part of your security posture, and a permission you granted in a hurry is a permission someone else will eventually use. If your review of a new SaaS app takes longer than a coffee, the attacker’s automation will beat your review.
We also think dual-use frameworks will be the hardest policy fight of the next year. ARTEX was built to help defenders test their own systems. The same reconnaissance graph helped a state-aligned group move faster. Banning the tool will not work, because the code is already everywhere. The better bet is getting defenders to adopt agentic testing first, and fast. We are not confident that will happen on schedule.