Microsoft Threat Intelligence says a China-state-aligned group it tracks as Storm-0940 used ARTEX, an open-source penetration-testing framework built from several AI agents, to automate attacks on hundreds of organisations worldwide from as early as September. In several cases the group gained privileged access to cloud environments in under three hours, Microsoft wrote on 21 October.
Microsoft also assesses that Storm-0940 was behind the recently disclosed compromise of a ConnectWise multi-tenant application, which let it sign in to downstream Microsoft 365 tenants through apps that already had access. Sign-ins were attempted at more than 2,250 tenants. Microsoft says most targeting failed and that its own systems were not compromised.
Why it matters: tools built to help defenders test their own systems are now being turned on real targets, and AI agents shrink the time between a first foothold and serious damage.
What to do: Microsoft advises keeping affected ConnectWise app connections disabled until ConnectWise issues restoration steps, preserving logs before deleting anything, finding affected apps by application ID in every tenant, reviewing sign-in and audit records from at least 15 October, and watching for unexpected new credentials, role assignments and consent grants.