[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1woeiNkIscfzAONn6LGg2qRwVZiyROW7nnYYM5PTcP4":3},{"article":4,"iocs":56,"watch_terms":57,"solutions":58,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"40d199a3-d30a-416b-90d9-1a27ae1e606d","AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise","ai-driven-large-scale-nation-state-campaign-using-artex-enables-supply-chain-com-f111d3","Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments. The post AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise appeared first on Microsoft Security Blog.","China-aligned threat actor Storm-0940 has been observed using the agentic AI penetration testing framework ARTEX to automate large-scale supply chain attacks. This integration of AI has significantly accelerated their operations, enabling them to achieve privileged access to cloud infrastructure in as little as three hours. Microsoft assesses that Storm-0940 was responsible for the recent ConnectWise supply chain compromise, highlighting how AI can exponentially scale threat actor capabilities.","China-aligned Storm-0940 uses AI framework ARTEX for rapid supply chain attacks.","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F10\u002F21\u002Fstorm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise\u002F","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002Fwp-content\u002Fuploads\u002F2026\u002F05\u002FMS_Actional-Insights_Storm.jpg","2026-10-21T18:23:55+00:00","2026-10-21T20:00:10.820688+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Storm-0940","threat_actor",{"name":21,"type":22},"ARTEX","technology",{"name":24,"type":25},"Microsoft 365","product",{"name":27,"type":25},"Microsoft Defender XDR",{"name":29,"type":25},"Microsoft Graph",{"name":31,"type":32},"ConnectWise supply chain compromise","campaign","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":33,"icon":35,"name":36,"slug":37},null,"Nation-state","nation-state",[39,44,46,51],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[24,27,29],{"controls":59,"vendors":141},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":90,"name":91,"problem":92,"products":93},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":119,"name":120,"problem":121,"products":122},"saas-security-posture","SaaS security posture management (SSPM)","Business apps like Microsoft 365 and Salesforce stop leaking through risky settings and connected apps.",[123,128,134],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":124,"product_name":125,"url":126,"description":127},"falcon-shield","Falcon Shield","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Ffalcon-shield\u002F","SaaS security posture management, from CrowdStrike's acquisition of Adaptive Shield.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":129,"product_name":130,"url":132,"description":133},"appomni","AppOmni","\u002Fvendor-logos\u002Fappomni.png","https:\u002F\u002Fappomni.com\u002F","SaaS security posture management for platforms such as Salesforce, Microsoft 365 and ServiceNow.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":136,"url":139,"description":140},"obsidian-security","Obsidian Security","\u002Fvendor-logos\u002Fobsidian-security.png","obsidian","https:\u002F\u002Fwww.obsidiansecurity.com\u002F","SaaS posture management and detection of account and integration compromise.",[142],{"slug":143,"name":144,"logo_path":145,"roles":146},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"ai-powered-nation-state-actor-automates-supply-chain-compromise-in-hours","AI-Powered Nation-State Actor Automates Supply Chain Compromise in Hours","China-aligned threat actor Storm-0940 leveraged the agentic AI framework ARTEX to dramatically accelerate supply chain attacks, achieving privileged cloud access in as little as three hours — a timeline that outpaces most traditional detection and response capabilities. The ConnectWise supply chain compromise illustrates how trusted software vendors can become force multipliers for adversaries, granting them access to thousands of downstream organizations simultaneously. AI-driven attack automation removes the human bottleneck from offensive operations, meaning defenders can no longer rely on attack dwell time to mount a response. This incident underscores that supply chain risk management and rapid privilege monitoring are no longer optional — they are existential necessities for modern organizations.",[153,154,155,156,157,158,159],"CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","MITRE ATT&CK T1566: Phishing","NIS2 Article 21(2)(b)","CIS Control 7: Continuous Vulnerability Management",{"NIS2 Article 21(2)(b)":161,"MITRE ATT&CK T1566: Phishing":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"CIS Control 17: Incident Response Management":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 explicitly mandates supply chain security measures for essential entities; Storm-0940's exploitation of a trusted vendor relationship is precisely the scenario this article was designed to compel organizations to defend against.","While the primary vector was supply chain, ARTEX-driven campaigns often combine automated credential harvesting and social engineering techniques that map to initial access tactics tracked under ATT&CK, reinforcing the need for layered defenses.","The ConnectWise compromise exploited vulnerabilities in a widely deployed remote management tool; timely flaw remediation and vendor patch monitoring would have reduced the attack surface available to Storm-0940.","Storm-0940 achieved privileged access in under three hours, meaning only a pre-planned, automated incident response capability could realistically detect and contain the intrusion before significant damage occurred.","Automated, AI-accelerated attacks exploit known vulnerabilities faster than manual patch cycles allow; continuous vulnerability scanning and enforced remediation SLAs are essential to close windows of exposure before agentic attackers can exploit them.","Continuous tracking and remediation of vulnerabilities within third-party software integrated into the supply chain is directly required by this control and would have limited the adversary's initial foothold.","The attackers rapidly obtained privileged cloud access through the compromised supply chain vector; enforcing least-privilege and just-in-time access would have constrained the scope of that privilege escalation."]