China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
China-linked Storm-0940 APT uses AI pentest tool Artex to automate ConnectWise attacks targeting hundreds of orgs.
Run Microsoft?
Get an email when a reviewed story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A China-linked APT tracked as Storm-0940 has been leveraging the open-source AI penetration testing framework Artex to automate large-scale attacks against ConnectWise customers since mid-October 2026. The threat actor used Artex to accelerate reconnaissance, password spraying, and OAuth application abuse at machine speed, compromising over 300 Microsoft Entra tenants across eight organizations and attempting to sign into more than 2,250 tenants. By modifying application credentials, the attackers established persistent access to victim environments even after remediation efforts.
The lesson from this incident
Full lessonStorm-0940 weaponized the open-source AI penetration testing tool Artex to conduct machine-speed password spraying and OAuth application abuse against ConnectWise customers, overwhelming defenses that were designed for human-paced attacks. The attackers modified application credentials within compromised Entra tenants to establish persistent backdoors, meaning that even organizations that attempted remediation remained exposed. This incident highlights how AI-assisted offensive tooling dramatically compresses the attack timeline, leaving defenders little window to detect and respond before persistence is established. The abuse of OAuth applications as a persistence mechanism underscores the critical importance of hardening identity configurations and continuously auditing registered applications and their permissions.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- malware — Artex