Chinese hackers let an AI pentest kit loose on 2,250 tenants. Admin access took under 3 hours

For years the joke in security circles was that attackers only had to get lucky once. Microsoft's latest threat report suggests a new version: attackers no longer need to get lucky, because they can now afford to try everything, all at once, around the clock.

On October 21, Microsoft Threat Intelligence published its account of a campaign by Storm-0940, a China-state-aligned group it has tracked since 2021. The headline number is stark. According to Microsoft, "Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute." In several cases, Microsoft says, the time from first contact to privileged cloud access was under three hours.

Meet ARTEX

ARTEX is the part of this story that should keep defenders up at night, because it was never built as a weapon. Microsoft describes it as "a system of LLM-driven agents that run an autonomous penetration test," and notes that "ARTEX is an open-source penetration testing framework that can use any AI model."

It's written in Go with a Next.js front end. It stores the assets and weaknesses it finds as a graph, so the agents build a map of a victim as they go. It works in English, Korean, Mandarin, Spanish and Japanese. Per Microsoft, it can run a full engagement, from reconnaissance through data exfiltration, with very little human input. Red teams use tools like this to test their own clients. Storm-0940 used it on everyone else's.

Microsoft says the group started using ARTEX as early as September 2026, against hundreds of organizations in government, defense, energy, financial services and more.

The spray that failed

Between October 10 and 14, infrastructure Microsoft ties to the group ran an automated password spray against 327 Microsoft 365 and Exchange Online accounts at eight organizations. It produced more than 151,000 failed logons, peaking at 2,900 failures a minute on October 11. Microsoft says not one attempt succeeded.

A human crew might have regrouped for a few weeks after that. The agents moved on the next day.

Through the backup provider's front door

On October 15, reports surfaced of a compromise at ConnectWise's cloud backup service, a product managed service providers use to protect their customers' Microsoft 365 data. On October 16, ConnectWise said attackers had accessed customer tenants using multiple OAuth application identities. Its advisory later confirmed an IP address that matched the spray infrastructure. Microsoft now says it assesses that "Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise."

This is where the attack gets clever, and a little depressing. A backup app needs broad permission to read a company's mail and files, and customers grant that permission once, then forget about it. Once Storm-0940 controlled several of ConnectWise's application identities, it could use that stored trust to sign straight into customer tenants, with no password, no MFA prompt and no user involved at all.

In some environments the agents kept going. Microsoft lists reconnaissance through Microsoft Graph, new application credentials added for persistence, and changes to identities, groups and privileged roles. One of Microsoft's detections describes a ConnectWise management application granting itself the Global Administrator role. That is a backup tool appointing itself king of the tenant.

Microsoft's researchers put the lesson politely: "a compromised third-party application with high privileges could provide access beyond its originally intended purpose."

What we still don't know

Microsoft did not say how many customers were actually breached, and CyberScoop notes that a successful authentication doesn't confirm data was accessed or stolen. Microsoft also says the attack "did not result from a compromise of or a vulnerability in Microsoft corporate systems." The doors were in Microsoft's cloud, but the key that opened them belonged to a third party.

ConnectWise shut its affected services down on Saturday and began a phased restoration on Wednesday, according to CyberScoop, telling customers to keep connections disabled and warning that recovery could take several days.

Microsoft's own advice has one line that stands out: "Do not delete enterprise applications as the first response." The instinct to rip out the compromised app destroys the evidence of what it did. Microsoft wants defenders to preserve logs, hunt for the four affected application IDs by ID instead of display name, and review activity going back to at least October 15, ideally October 1.

Not a one-off

The quote that should worry people came from Igor Tsyganskiy, an executive vice president at Microsoft, writing on LinkedIn: "Since early October, a wave of AI-driven cyberattacks has been ongoing," he said, according to CyberScoop, calling the ConnectWise attack "one of many."

For a long time the limiting factor on an intrusion campaign was skilled people. You could only run as many operations as you had operators who knew what they were doing. Agent frameworks remove that ceiling. They don't sleep, they don't get bored after 151,000 failed logins, and they don't mind trying a dozen paths in parallel to see which one breaks.

The uncomfortable takeaway from this report is about time. Three hours from first probe to admin rights is shorter than a lot of companies' on-call response window. Picture the pager going off at 2am. By the time someone finds their laptop and logs in, the agent may already have promoted itself.

Sources: Microsoft Security: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, CyberScoop: Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group.