Microsoft Security Research attributed the ConnectWise Cloud Backup supply-chain attacks to a Chinese state-aligned actor it tracks as Storm-0940, which it says used an open-source agentic AI penetration-testing framework called ARTEX to automate intrusion work from as early as September 2026. In a four-day password-spraying campaign ending 14 October the group targeted 327 Microsoft 365 and Exchange Online accounts across eight organisations, generating more than 151,000 failed logons and peaking at 2,900 failures per minute; the same infrastructure was turned on ConnectWise the following day, reaching more than 2,250 tenants. Microsoft says the AI agents progressed beyond authentication into Microsoft Graph and directory operations, modifying application credentials for persistence, and that in several cases privileged cloud access was achieved in under three hours. ARTEX, published on GitHub this year by an account tracked as "Autumn-27", coordinates a team of agents to run an autonomous penetration test. Zscaler reported that the campaign reached dozens of industries across multiple countries.

• Source article