ARTEX AI agent targeted 2,250+ Microsoft 365 tenants, Microsoft says

Microsoft says a China-state aligned actor it tracks as Storm-0940 used an agentic AI penetration testing framework called ARTEX to attempt sign-ins to more than 2,250 tenants, following a compromise of ConnectWise. Microsoft published its analysis on Wednesday and says the activity did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.

The headline is the AI agent. The story underneath it is an old one: a trusted vendor, a multi-tenant application and credentials that opened a lot of doors.

What Microsoft says happened

Microsoft assesses that Storm-0940 was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application. Cybersecurity Dive reports that the affected product is ConnectWise Cloud Backup, formerly known as SkyKick, which managed service providers use to back up Microsoft 365 and Google Workspace data. ConnectWise suspended access to Cloud Backup after suspicious activity was first detected on October 14, and also shut off its SaaS Security and Cloud Management services.

After the unauthorized access, according to Microsoft, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute. Microsoft's own phrasing is that this is "a pace that leaves defenders with little time to detect and respond." In several attacks, the company says, the time from initial targeting to privileged access to cloud infrastructure was under three hours.

ConnectWise CEO Manny Rivelo said in a separate statement that, based on Microsoft's analysis and the evidence available to ConnectWise, "it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup." CNBCTV18 reports that he also said containing application connections does not remove unauthorized access already established inside customer tenants.

A spokesperson for the Chinese Embassy in Washington said China "opposes and fights hacking activities in accordance with the law. At the same time, we oppose smears and attacks against China under the excuse of cybersecurity issues."

The tool and the numbers

ARTEX, per Microsoft, is a multi-agent LLM system written in Go with a Next.js front end. The interface and generated output default to English but can be switched to Korean, Mandarin, Spanish or Japanese. The company describes it as open source. Cybersecurity Dive reports that CrowdStrike researchers have connected ARTEX to AI-based attacks on Korean banks, and researchers in Japan have tied it to a campaign against Japanese companies.

Storm-0940 is not new. Microsoft says it has been active since 2021, has no known industry aliases, and has historically leaned on password spraying and exploiting internet-facing applications to steal data. The AI layer is the novelty, and the sectors it hit are broad: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits.

One data point shows how this looks from the defender's chair. Between October 10 and 14, Microsoft says, Storm-0940 infrastructure ran a cross-tenant password-spray campaign against 327 accounts across eight organizations. Telemetry captured more than 151,000 failed logon events, peaking on October 11 at 2,900 failures per minute, with more than 111,000 failures in a single day. Microsoft's summary says that campaign produced no successful authentication.

That is a lot of noise for no result, and a useful reminder that speed is not the same as success.

Thousands hacked, or thousands targeted?

The coverage does not agree on scale, and the difference matters. TechCrunch's headline says Chinese hackers spied on thousands of companies, and its text says the hackers used AI agents to rapidly hack into thousands of ConnectWise's customers. Microsoft and The Register describe more than 2,250 tenants targeted, with most attempts failing. Microsoft also notes that the presence of an application or an authentication does not necessarily mean data was accessed or exfiltrated.

A smaller wrinkle: Cybersecurity Dive describes the password-spray campaign as hitting "327 organizations across eight organizations." That is arithmetically strange. Microsoft's report says 327 accounts, and I would use Microsoft's version.

The reporting cited here does not establish how many tenants were actually compromised and had data taken.

What it means

Huntress's Jon Semon told Cybersecurity Dive: "Our working hypothesis is that these attacks were conducted by an AI agent leveraging scripted tooling, with occasional human intervention." That is the sober reading. It describes automation with occasional human intervention, not a wholly human-free operation. Nothing in the reporting so far says what ARTEX did that a competent scripted toolkit could not, and Microsoft's report does not say which underlying language models ran inside the framework during this campaign.

What the agent plausibly changed is tempo: under three hours from target to privileged access, 2,900 attempts a minute, a framework that switches interface languages on request. Those are Microsoft's figures, and they are about speed and scale, not about novel exploitation. The access route ran through a vendor supply chain compromise. How the attackers first obtained the application credentials remains unanswered.

Show me the eval, not the vibe: there is no benchmark here comparing ARTEX with a human operator, so "AI-driven" describes the workflow, not a measured capability jump.

For context, ConnectWise said in May 2025 that a "sophisticated nation-state actor" had broken into its systems and compromised a small number of ScreenConnect customers. The Register notes there is nothing to suggest the two incidents are linked.

What to watch

• The real victim count. Authentication attempts are not breaches. Look for ConnectWise or Microsoft to say how many tenants lost data.
• The initial access. How Storm-0940 got the application credentials and identities inside Cloud Backup is still unanswered.
• The model under the hood. Which LLMs ARTEX called in this campaign would say a great deal about who can run this playbook next.
• Cleanup. Rivelo's point stands: shutting off the application does not evict an attacker already inside a customer tenant.