---
format: "aidr-story-markdown/v1"
id: "9dd0fa72bd9bf8f90e9c1dfac68df6c0b1afc10c54986def5a084165ca53e0b7"
canonical_url: "https://aidr.today/9dd0fa72?lang=en"
title: "Storm-0940 Used AI Tool ARTEX to Automate ConnectWise Attacks"
lang: "en"
requested_lang: "en"
available_langs: ["en","vi"]
translation_fallback: null
fallback_fields: []
published_at: "2026-10-22T01:38:45.000Z"
category: "Agents"
topics: ["microsoft","agent","safety"]
source_urls: ["https://marketbrief.now/cybersecurity/storm-0940-used-ai-tool-artex-to-automate-connectwise-attacks-0b3f0175","https://x.com/MsftSecIntel/status/2112975078266716390","https://x.com/Reuters/status/2113062833512382725","https://x.com/BleepinComputer/status/2111477101194797406","https://x.com/SpecterOps/status/2111565631837327691","https://x.com/cyb3rops/status/2111611236387258513","https://x.com/AlvieriD/status/2112198547906986483","https://x.com/MalwareJake/status/2112248640680910955"]
summary: "Microsoft Threat Intelligence reports that Storm-0940, a China state-aligned actor, used the AI penetration testing tool ARTEX to automate attacks on Microsoft 365 tenants via a supply chain breach of ConnectWise Cloud Backup, modifying privileges and establishing persistent access across hundreds of organizations. ConnectWise responded by suspending backup and restoration services and disabling 7 app identities, though analysts warn that overprivileged OAuth applications may have exposed a wider range of downstream customers."
---

# Storm\-0940 Used AI Tool ARTEX to Automate ConnectWise Attacks

> [Open the canonical story](<https://aidr.today/9dd0fa72?lang=en>)

**Published:** 2026-10-22T01:38:45.000Z
**Category:** Agents
**Topics:** microsoft, agent, safety

## Summary

Microsoft Threat Intelligence reports that Storm\-0940, a China state\-aligned actor, used the AI penetration testing tool ARTEX to automate attacks on Microsoft 365 tenants via a supply chain breach of ConnectWise Cloud Backup, modifying privileges and establishing persistent access across hundreds of organizations\. ConnectWise responded by suspending backup and restoration services and disabling 7 app identities, though analysts warn that overprivileged OAuth applications may have exposed a wider range of downstream customers\.

## Sources

- [Story source](<https://marketbrief.now/cybersecurity/storm-0940-used-ai-tool-artex-to-automate-connectwise-attacks-0b3f0175>)
- [Story source](<https://x.com/MsftSecIntel/status/2112975078266716390>)
- [Supporting source](<https://x.com/Reuters/status/2113062833512382725>)
- [Supporting source](<https://x.com/BleepinComputer/status/2111477101194797406>)
- [Supporting source](<https://x.com/SpecterOps/status/2111565631837327691>)
- [Supporting source](<https://x.com/cyb3rops/status/2111611236387258513>)
- [Supporting source](<https://x.com/AlvieriD/status/2112198547906986483>)
- [Supporting source](<https://x.com/MalwareJake/status/2112248640680910955>)