What Is ARTEX? The AI Hacking Agent Behind the ConnectWise Breach

Microsoft says a China-state-aligned group used ARTEX, an open-source AI agent framework, to automate the ConnectWise Cloud Backup attack and try sign-ins at more than 2,250 Microsoft 365 tenants. Here’s what ARTEX is, what happened, and what admins should check.

[email protected]

Oct 25, 2026, 12:39 PM7 min read

Abstract indigo illustration of a glowing AI agent at the centre of a network, sending lines to many tenant nodes, with a few highlighted in red, and the headline The AI agent that knocked on 2,250 doors

For years, security people have warned that AI agents would eventually be pointed at real networks by real attackers. This week Microsoft put a name, a group and a set of numbers on it. In a report published on 21 October 2026, the company said a China-state-aligned hacking group it tracks as Storm-0940 used ARTEX, an open-source “agentic AI penetration testing framework,” to automate attacks on hundreds of organizations, and that the same group was behind the ConnectWise Cloud Backup supply-chain compromise that has kept IT teams busy since mid-October.

The story has spent the past several days near the top of security and AI feeds, with more than 30,000 posts on X mentioning ARTEX or Storm-0940 in a week, by our count. Here’s what ARTEX is, what actually happened, which numbers mean what, and what it changes for anyone who gives software, or an AI agent, the keys to their accounts.

What is ARTEX?

Microsoft describes ARTEX as an open-source penetration testing framework that “can use any AI model” to automate offensive security work. It’s a multi-agent system written in Go with a Next.js front end, and its LLM-driven agents run a test “from reconnaissance through data exfiltration with little needed human interaction,” building a graph of the assets and weaknesses they find along the way.

In other words, ARTEX isn’t a new AI model, and it isn’t a software vulnerability. It’s an orchestration layer: a set of agents that plug into whatever chatbot or model the operator chooses and then chain together the tedious parts of hacking, like scanning, guessing passwords and probing permissions, without getting tired. Reuters, via The Straits Times, notes that it connects to external models such as ChatGPT, Claude and DeepSeek rather than shipping its own.

ARTEX was already notorious before Microsoft’s report. On 7 October, CrowdStrike said an unnamed, likely Chinese-speaking and financially motivated actor had used ARTEX alongside large language models in a campaign against South Korean financial organizations that ended in stolen data. CrowdStrike found Claude Code session histories and ARTEX configuration files in the attacker’s open directories, with DeepSeek as the main model behind the ARTEX instance. A day later, the developer, who uses the GitHub handle Autumn-27, said the project “will no longer be updated and will be converted to closed source,” Reuters reported. Copies released before that are still out there, and Microsoft says it has seen threat actors “across multiple geographic regions” using the framework. CrowdStrike’s report doesn’t link the Korean campaign to Storm-0940.

Illustration of two monitors in a dark security operations room: one shows failed sign-ins spiking to 2,900 per minute, the other a Sev 1 alert queue filling with service principal sign-ins, password spray lockouts and role changes — Illustration

What happened at ConnectWise

ConnectWise Cloud Backup, formerly SkyKick, is a service managed service providers (MSPs) use to back up their clients’ Microsoft 365 data. To do that, its app is granted broad access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it’s installed. That access is exactly what made it valuable to an attacker.

According to security firm Huntress, on 15 October the app’s identity signed in to customer Microsoft 365 tenants from a hosting-provider IP address and collected Microsoft Graph access tokens. The credential was held in ConnectWise’s own tenant, so nothing customers did could have prevented it, and because the attacker was signing in as an application rather than a person, multi-factor authentication never came into play. Huntress said the attacker moved through tenants in sorted order, a few seconds apart, which “points to a script working from a target list.” By the evening of 16 October it had confirmed unauthorized sign-ins in 162 tenants.

In one tenant, a related ConnectWise Cloud Management app gave itself Global Administrator, the highest role in Microsoft 365, and then added new credentials to two other apps. That’s the part defenders worry about most: Microsoft warns that such changes “can remain active as a backdoor” even after the original app is cleaned up.

ConnectWise disabled seven app identities on 17 October and took Cloud Backup offline. On 21 October it said that “it appears that a China state-aligned group was responsible.” In its 24 October update, the company said restoration and security checks would continue through the weekend, with a target of starting phased partner onboarding on Monday, 26 October. It says existing backup archives “remain encrypted, isolated and preserved, with no indication of compromise.”

Where the AI came in

Storm-0940 isn’t new. Microsoft says it has been active since 2021 and has long relied on password spraying, exploiting internet-facing apps and adding credentials to existing OAuth applications. What changed, according to Microsoft, is the speed. “While OAuth application abuse is a typical part of Storm-0940’s toolset, in this case the actor used ARTEX to accelerate the activity to machine speed,” the report says.

The numbers behind that phrase:

More than 2,250 tenants. After the ConnectWise access, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 Microsoft 365 tenants. That’s a count of attempts, not confirmed breaches, and Microsoft says “the majority of the targeting wasn’t successful.”
2,900 failures a minute. In a separate password spray from 10 to 14 October, aimed at 327 accounts across eight organizations, Microsoft logged more than 151,000 failed sign-ins, peaking at 2,900 per minute on 11 October. Microsoft says none of those attempts succeeded.
Under three hours. In “multiple instances,” the time from first targeting an organization to privileged access to its cloud was less than three hours.

Microsoft says the targets since September span aerospace and defense, energy, financial services, government, legal, manufacturing, semiconductors, technology and think tanks, among others. It also stresses that none of this came from a flaw in Microsoft’s own systems, and that an affected app, or even a successful sign-in, “does not necessarily indicate that customer data was accessed or exfiltrated.”

Timeline infographic of the ARTEX and ConnectWise breach from 7 to 26 October 2026, with key figures: more than 2,250 Microsoft 365 tenants with attempted sign-ins, under 3 hours to privileged cloud access, and a peak of 2,900 failed sign-ins a minute — The ARTEX and ConnectWise timeline. Sources: Microsoft Threat Intelligence, Huntress, ConnectWise, CrowdStrike, Reuters.

Why this one matters

Password spraying and OAuth app abuse are old tricks. What’s new is that an off-the-shelf agent framework made them run around the clock, in parallel, across thousands of targets. Microsoft puts it bluntly: agents “can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously.”

That squeezes the defenders’ window. “2,900 sign-in attempts per minute and gaining privileged cloud access in under three hours is not a timeline any human analyst queue can keep up with, no matter how well-staffed the SOC,” Yih Khai Wong of IDC told CSO Online, adding that “relying on a human to click ‘approve’ will not cut it.” Yash Kadakia of Security Brigade made the other point: “We’ve spent years implementing zero trust for humans while continuing to implicitly trust machines.”

It’s also the darker side of a week in which the AI industry has been building fences around its own agents. Vendors are shipping tools to watch and stop AI agents inside companies, and OpenAI now trains its frontier models with no live internet access after one slipped out of its sandbox. ARTEX shows the same agent tricks pointed outward, on purpose, by people who don’t want any fences at all.

Illustration of a laptop showing a tenant admin audit log where a third-party backup app adds itself to the Global Administrator role and adds client secrets to two other apps, with a warning that disabling the app will not remove those secrets — Illustration

What to do if you run Microsoft 365

Microsoft, Huntress and Expel give overlapping advice. The short version:

Disable, don’t delete. If any tenant you manage has ever had ConnectWise Cloud Backup, SkyKick or ConnectWise Cloud Management apps, disable them and keep them disabled until ConnectWise publishes instructions for your service. Deleting them destroys evidence.
Search by application ID, not by name. Display names can differ between tenants. Microsoft’s report lists the IDs and ready-made hunting queries.
Check every app’s secrets. Look for credentials, owners, role assignments and consent grants added since 13 October that you didn’t create, especially anything that made itself Global Administrator. Disabling the ConnectWise apps won’t remove secrets planted on other apps.
Don’t trust a quiet log. Expel notes that Microsoft Graph directory reads leave no Entra audit record. It also saw the same attacker infrastructure abuse a customer’s Okta self-service registration with no ConnectWise app involved, so search your other identity providers too.
Treat vendor apps like admins. Give third-party integrations the minimum permissions they need, review them regularly and remove the ones you no longer use.

The same rule applies at home. If you hand a personal AI agent your logins, it holds the same kind of standing access that made the ConnectWise app so useful to an attacker, which is why some banks are already locking out AI agents and pushing for scoped access.

What we still don’t know

Plenty. ConnectWise hasn’t said how the app credential was stolen. Nobody has published a count of organizations that actually lost data. Microsoft frames its attribution as an assessment, and the restoration dates ConnectWise has shared are targets, not promises. What’s clear is that agentic attacks have moved from conference slides to incident reports. The next question is whether defenders can automate their response as fast as attackers have automated their offense.

Sources

AI safety Explainer