Microsoft attributed the ConnectWise compromise to Storm-0940, which has used ARTEX, an open-source multi-agent AI penetration testing framework, since September. After taking over ConnectWise cloud app identities it attempted sign-ins to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts per minute, reaching privileged cloud access in under three hours in several cases. Targets spanned defense, energy, government, finance and think tanks.
What to do: Disable the affected ConnectWise app IDs until restoration guidance; hunt back to October 1. Oct 31: CrowdStrike: Chinese state hackers used AI-powered ARTEX against 200+ organizations, with post-exploitation confirmed at nine (BLOODALCHEMY malware); AI agents ran parallel attack paths under human direction.
AI angle: First Microsoft attribution of a nation-state supply chain campaign to an autonomous AI agent framework (ARTEX runs on any model).
Chinese 🇨🇳 Storm-0940 weaponized the ARTEX agentic AI framework to compromise ConnectWise's supply chain, hitting 2,250+ tenants at machine speed and achieving privileged cloud access in under 3 hours. Key findings: -
🚨 Chinese state-sponsored hackers used AI-powered ARTEX to target over 200 organizations worldwide. CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware. AI agents ran parallel attack paths under human direction. Full
Why this score
Thousands of tenants across defense, energy and government (impact 3), successful mass intrusion with persistence (exploitability 3), critical sectors primary (criticality 2).
time of earliest verified post