China-linked group Storm-0940 used the open-source AI pentesting tool ARTEX and compromised ConnectWise application credentials to attempt authentication against more than 2,250 Microsoft 365 tenants, gaining privileged access at some organizations in under three hours.
Occurred 10 October 2026 · Disclosed 22 October 2026 · Record updated 22 October 2026
Attackers used AI-driven automation (ARTEX) combined with compromised ConnectWise application identities to attempt unauthorized access to over 2,250 Microsoft 365 tenants, achieving persistent privileged access at some organizations including government agencies, defense contractors, banks, and manufacturers.
IncidentsMicrosoft says Storm-0940 used an open source AI pentesting framework and stolen ConnectWise application credentials to reach privileged cloud access in under three hours.
22 Oct 2026
