Microsoft attributes a supply-chain campaign to agentic AI framework ARTEX
Microsoft Threat Intelligence published a report on 21 October 2026 attributing a supply-chain compromise of a ConnectWise multi-tenant cloud backup application to Storm-0940, which it describes as a China state-aligned actor. Using stolen application credentials, the group ran ARTEX, an open-source agentic AI penetration-testing framework, to attempt sign-ins to more than 2,250 Microsoft 365 tenants at 2,900 sign-in attempts per minute. Microsoft separately documented an ARTEX-driven password-spray campaign from 10 to 14 October against 327 accounts at eight organisations, logging more than 151,000 failed attempts with no successful authentication in that campaign. Microsoft said most of the broader targeting failed but that the actor achieved privileged cloud persistence at many organisations in a short period, and that the activity did not stem from a vulnerability in Microsoft products.
Why It Mattered
This is the first large-scale nation-state intrusion campaign that a major vendor has attributed, in technical detail, to an agentic AI framework operating across the attack chain rather than to human operators assisted by a model. ARTEX agents carried reconnaissance, authentication attempts, OAuth abuse and privilege escalation forward with minimal human interaction, and the volumes Microsoft recorded — thousands of tenants, thousands of sign-in attempts per minute — are the operational signature of that shift. Earlier reporting on AI-enabled intrusion generally concerned productivity gains for existing crews; here the machine set the tempo. Two features make it durable as a reference point. First, the tooling was open source and already in circulation: Microsoft notes that ARTEX had been publicly reported in connection with breaches at South Korean financial institutions, meaning the capability was not gated behind a frontier lab's deployment controls and could not be withdrawn. Second, the attack path ran through a managed-service supply chain, so a single compromised multi-tenant application became a key that agents could turn against hundreds of downstream environments faster than defenders could inventory the exposure. The report also sharpens a defensive argument that was previously theoretical. Detection models tuned to human-paced credential attacks have little value against machine-speed enumeration, and Microsoft's guidance — disabling affected integrations, auditing OAuth application grants, preserving evidence — reflects the assumption that containment must now be automated as well. Together with the same week's AI-assisted discovery of critical PHP flaws, it marks October 2026 as the point at which both offence and defence in cybersecurity were publicly documented running on agents.
Who Built It
Microsoft Threat Intelligence
Applications
- Cybersecurity
- Threat Intelligence
- Cloud Security