State-linked Chinese hackers used the open-source ARTEX AI penetration testing tool to compromise a series of Microsoft 365 environments linked to ConnectWise’s Cloud Backup offerings, Microsoft said in an advisory.

ARTEX, a framework that works with any AI model to automate penetration testing tasks, has recently been linked to waves of attacks on South Korean financial institutions and Japanese companies across multiple sectors.

Microsoft said the ConnectWise attack was part of a broader campaign carried out by a state-backed Chinese group it tracks as Storm-0940.

Open-source framework

“As early as September 2026, Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organisations globally across a broad range of industries,” Microsoft said in a Wednesday advisory.

During the campaign the group, which has been active since 2021, targeted organisations in aerospace and defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits, Microsoft said.

On 15 October, the group used ARTEX to compromise a series of Microsoft 365 environments belonging to ConnectWise Cloud Backup customers, Microsoft said.

Storm-0940 used ARTEX to accelerate scanning, conduct password-spray attacks and abuse OAuth applications in downstream victims, the company said.

“Storm-0940 used ARTEX to reach more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace that leaves defenders with little time to detect and respond,” Microsoft stated.

ConnectWise temporarily shut down affected services last Saturday as a result of the attack and said on Wednesday it was beginning the restoration process.