The agents did not need a coffee break. The defenders barely got an alert window.
On 21 October 2026, Microsoft published its attribution that Storm-0940, a China-state-aligned actor active since 2021, used the open-source multi-agent penetration testing framework ARTEX to accelerate attacks that Microsoft links to the ConnectWise Cloud Backup supply-chain compromise. The post is unusually concrete for agent-offence coverage: named framework, timing from targeting to privileged access, spray telemetry, downstream Graph abuse, and a mitigation list keyed to service-principal forensics.
Storm-0940 adds ARTEX to a familiar cloud-theft playbook
Microsoft describes Storm-0940 as focused on data theft across aerospace and defence, energy, financial services, government, semiconductors, and other sectors. Historical access paths include password spraying and exploitation of internet-facing applications, then persistence by adding credentials to existing OAuth applications for Microsoft Graph access to mail and other data.
ARTEX, as Microsoft summarises it, is an open-source Go multi-agent system with a Next.js frontend that can drive an autonomous pentest from reconnaissance through exfiltration while accumulating assets in a graph. Language UI defaults to English with switches for Korean, Mandarin, Spanish, or Japanese. Public reporting in October 2026 had already tied ARTEX to other regional campaigns; Microsoft says actors across multiple geographies are using it. ConnectWise's advisory trail began 16 October 2026 on unauthorised access associated with Cloud Backup.
Under-three-hour privilege, a 2,250-tenant wave, and spray peaks at 2,900 failures a minute
Microsoft assesses that Storm-0940 used ARTEX to accelerate scanning, reconnaissance, password spraying, and OAuth application abuse against downstream victims of the ConnectWise compromise. Several ARTEX-driven attacks yielded privileged access to cloud infrastructure, including multiple cases where the time from initial targeting to privileged access was less than three hours.
After control of ConnectWise cloud application identities, agents authenticated to customer environments using already-trusted app credentials, without interactive user sign-in. In some tenants they then moved into Microsoft Graph reconnaissance, application credential changes, and privilege modifications.
Following the unauthorised access, Storm-0940 used ARTEX to attempt sign-ins to more than 2,250 tenants. Between 10 and 14 October, infrastructure at 144.172.64.99 ran a cross-tenant password-spray against 327 accounts across eight organisations. The campaign generated more than 151,000 failed logon events. Failures peaked on 11 October at about 2,900 per minute, with more than 111,000 concentrated in a single day. Microsoft says that spray produced no successful authentication.
On 15 October, public ConnectWise compromise reports surfaced with indicators overlapping the same 144.172.64.x range. ConnectWise's 16 October advisory later shared an IP matching 144.172.64.99.
ConnectWise advisories and Microsoft detections turned a vendor incident into a tenant hunt
ConnectWise published containment and restoration guidance starting 16 October. Microsoft's 21 October post adds actor attribution, ARTEX as the accelerator, IOC tables (including 144.172.64.128, .99, .60 and listed user agents such as Python-urllib/3.12 and python-requests builds), Defender XDR and Defender for Cloud Apps alert titles, and advanced hunting queries. The company stresses that presence of an affected application or even successful authentication does not by itself prove data exfiltration.
Preserve evidence, disable affected apps, hunt service principals before you delete them
Microsoft's immediate actions are operational rather than rhetorical. Keep affected ConnectWise application connections disabled until ConnectWise issues formal restoration steps. Do not delete enterprise applications as a first move; preserve configuration and evidence.
Inventory the published application IDs and local service-principal object IDs in every tenant where the apps were ever authorised. Review service-principal sign-ins and Entra audit records from at least 15 October, and earlier where logs allow, for credential additions, role assignments, consent grants, and directory changes.
Revoke confirmed unauthorised credentials only after preservation. Apply least privilege to multi-tenant app permissions going forward, and monitor anomalous app-only Graph activity.
Authentication evidence still leaves exfiltration unproven in the public post
Microsoft repeatedly separates authentication and follow-on Graph activity from confirmed customer-data access. The October spray section reports failure-only outcomes. Which specific ConnectWise application permissions Storm-0940 abused in each tenant, and how much of the ARTEX run was unsupervised versus operator-steered, are summarised at campaign level rather than as a per-tenant forensic appendix in the public post.
ARTEX's upstream maintainers and full ConnectWise root-cause detail stay thin in the Microsoft piece
Readers still lack a full public technical root-cause narrative from ConnectWise inside Microsoft's blog, and a clear statement of whether ARTEX's public repositories will change distribution or safeguards after this wave. Overlap with other October agentic-intrusion reporting (separate actors, different harnesses) is left for parallel coverage. Until vendor restoration guidance completes, tenants should stay on the disable-and-hunt path rather than assuming a clean bill from a single IOC sweep.