AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise

Summary

Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks against hundreds of organizations starting as early as September 2026. Several attacks gave the actor privileged access to cloud infrastructure, in some cases within 3 hours of initial targeting. Microsoft assesses that Storm-0940 was responsible for the ConnectWise supply chain compromise of a multi-tenant application.

Mitigation

Customers should review service principal sign-ins, investigate unexpected application credential or privilege changes, and follow ConnectWise's published containment guidance while preserving relevant evidence. Microsoft Defender XDR provides detections and hunting queries for suspicious Microsoft Graph activity.

Topics

• Model and package supply chain

Related items

• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSame vendor · TechCrunch (Security)
• InfoBill Gates says to prepare for 20 years of ‘tumultuous’ AI disruptionSame vendor · The Verge (AI)
• MediumARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsSame vendor · Wiz Research Blog
• MediumChina-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantsSame vendor · CSO Online
• InfoAI firms say UK has a year to head off datacentre protests before construction is threatenedSame vendor · The Guardian Technology