China-state-aligned actor Storm-0940 used the agentic AI penetration-testing framework ARTEX to automate attacks against hundreds of organizations worldwide, exploiting compromised ConnectWise OAuth applications to gain privileged access to Microsoft 365 customer cloud environments, in some cases within three hours.
Occurred 1 September 2026 · Disclosed 16 October 2026 · Record updated 21 October 2026
Storm-0940 achieved privileged cloud persistence at multiple organizations across many industries via compromised OAuth applications, conducting reconnaissance, credential changes, and privilege escalation through Microsoft Graph; Microsoft states presence of threat activity does not necessarily mean data was exfiltrated.
IncidentsMicrosoft says the China-state aligned actor Storm-0940 used the open-source agentic framework ARTEX to automate attacks on hundreds of organisations from September 2026.
21 Oct 2026
