Notes from Việt Nam on law, technology, languages, history, culture and travel.

Agents on the Other Side: Microsoft Ties the ConnectWise Breach to an AI Pentest Framework

For two years, “AI-powered attacks” mostly meant better phishing emails and faster exploit research done by people with a chatbot open. On Wednesday, 21 October 2026, Microsoft published the most detailed public account yet of something different: a nation-state campaign in which, by Microsoft’s description, AI agents operating on behalf of the threat actor carried out password spraying, signed in to customer tenants with stolen application credentials and then made directory changes, at a pace no human operator team would sustain.

The report, from Microsoft Threat Intelligence and Microsoft Security Research, attributes the campaign to Storm-0940, which Microsoft calls “a China-state aligned actor (with no known industry aliases) that has been active since 2021.” It also says Storm-0940 was “responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.” The tool in the middle is ARTEX, an open-source penetration-testing framework built for defenders.

What happened, in order

The timeline below comes from Microsoft’s post, with ConnectWise’s actions as reported by CyberScoop.

  • As early as September 2026: Microsoft says Storm-0940 began using ARTEX against “hundreds of organizations globally.” The list of targeted sectors is long: aerospace and defence, automotive, chemicals, energy, finance, government, legal, manufacturing, media, semiconductors, software, think tanks and others.
  • 10–14 October: a password-spray campaign from a small set of IP addresses hit 327 accounts at eight organisations, peaking on 11 October. Microsoft counted more than 151,000 failed logons, up to 2,900 failures per minute, and more than 111,000 in a single day. It observed no successful sign-in from this wave. Most of the “success” was account lockouts.
  • 15–16 October: Huntress reported a compromise of ConnectWise’s cloud backup service, and on 16 October ConnectWise disclosed unauthorised access to customer tenants through multiple ConnectWise OAuth application identities. One of the IPs in ConnectWise’s advisory matched the spray infrastructure exactly.
  • Saturday, 17 October: ConnectWise temporarily shut services down. It began restoring them in phases on 21 October and told customers to keep connections disabled while recovery, expected to take several days, continued.
  • 21 October: Microsoft published its attribution.

Microsoft’s headline scale figure for the ConnectWise stage is “more than 2,250 tenants at 2,900 sign-in attempts per minute,” and in one case “over 200 sign-ins in under 4 minutes using 4 application credentials.” It also says that across several ARTEX-driven intrusions, “the time from initial targeting to privileged access was less than 3 hours.”

What ARTEX is

Microsoft describes ARTEX as “an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows.” Technically it is “a multi-agent LLM system written in Go with a Next.js frontend.” Its agents write the assets and vulnerabilities they find into a shared graph as the test runs, so later agents can plan from what earlier ones discovered. The interface ships in English and can switch to Korean, Mandarin, Spanish or Japanese.

The project’s history is already messy. According to Zscaler and the Cloud Security Alliance, ARTEX appeared on GitHub in late July 2026 under the AGPL-3.0 licence, published by a Chinese developer. In early October, CrowdStrike linked it to a campaign against South Korean financial institutions that reportedly exposed personal data of tens of thousands of people. Technology.org reported that CrowdStrike also found the suspect’s working files, including Claude Code session histories alongside ARTEX configuration. The developer then said ARTEX would go closed-source with no further public releases. That stops future updates, not existing copies: forks of the code are still on GitHub. Zscaler also notes that ARTEX had a default blocklist meant to stop it targeting government and university networks, but nothing comparable for banks.

So this is not a bespoke state cyber-weapon. It is a public defender’s tool with an LLM planner, used unchanged by whoever downloaded it. Microsoft says it has seen “threat actors across multiple geographic regions leveraging the ARTEX framework.”

The attack chain a developer should care about

The most useful part of the report has little to do with AI. It is the OAuth application abuse.

ConnectWise, like many SaaS vendors, runs multi-tenant apps that customers approve once in Microsoft Entra ID. After that approval, the app’s service principal can call Microsoft Graph with app-only permissions, with no user and no MFA prompt. Once Storm-0940 held “the identities of multiple ConnectWise cloud applications,” its agents could authenticate to each customer tenant by reusing “the already established trust by these apps within a tenant,” which, Microsoft notes, “allowed the threat actor to operate without requiring an interactive user sign-in.”

In some tenants the agents went further: Graph reconnaissance, adding credentials to applications for persistence, and changes to users, groups and privileged roles. One of Microsoft’s detections describes a ConnectWise management application that “directly granted itself the Global Administrator role.”

This is where automation matters. Taking 2,250 tenants one at a time through enumerate → check permissions → plant persistence → escalate is slow, repetitive work for people. For an agent loop with a graph of findings, it is a batch job. As Microsoft puts it, agents “can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously.”

What Microsoft does not claim

The post is careful, and its limits matter:

  • Attribution is an assessment, not a proven fact, and Microsoft gives no public evidence linking Storm-0940 to a specific government.
  • Autonomy is not quantified. ARTEX runs “with little needed human interaction,” but Microsoft does not say how much human steering went into these intrusions. “AI-driven” here means an LLM agent framework did the hands-on-keyboard work. It does not mean humans were absent.
  • Impact is unclear. Microsoft says “the majority of the targeting wasn’t successful,” and that an affected app or a successful sign-in “does not necessarily indicate that customer data was accessed or exfiltrated.” Neither Microsoft nor ConnectWise has said how many customers lost data.
  • How the app credentials were obtained is not explained in Microsoft’s post.
  • The 2,900-per-minute figure appears both for the spray peak and for the ConnectWise sign-in pace. The post does not make clear whether those are the same measurement.

Microsoft also stresses that the activity “did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.”

Why it matters

Earlier this month, Microsoft’s annual Digital Defense Report warned that attackers were adopting AI faster than defenders. This report is the field evidence. Three lessons stand out:

  1. The cost of breadth has collapsed. Agent frameworks don’t need to be smarter than a skilled operator. They need to be tireless and parallel. Defences that rely on attackers getting bored, such as slow lockouts or “nobody will bother with our small tenant”, lose value.
  2. Machine identities are the soft spot. Service principals, OAuth apps and API secrets skip MFA by design. If you ship a multi-tenant app, your app’s credential is effectively a key to every customer that approved it. Request least-privilege Graph scopes, prefer certificate or federated credentials over long-lived secrets, rotate them, and alert on credential additions to your own app registrations.
  3. Dual-use tooling is now a live policy question. ARTEX went from GitHub release to bank breaches to a state-aligned supply-chain campaign in under three months, and closing the source came after the forks existed. Expect more pressure on open-source offensive agents, and on the model providers whose APIs power them.

For tenant admins, Microsoft’s immediate advice is practical: keep ConnectWise connections disabled until the vendor gives restoration instructions. Search sign-in and audit logs by application ID, not display name, back to at least 15 October and ideally 1 October. Preserve evidence before deleting enterprise apps. Look for new credentials, consent grants and role assignments on service principals.

The open question is how many of the other campaigns behind Microsoft EVP Igor Tsyganskiy’s line, “since early October, a wave of AI-driven cyberattacks has been ongoing,” will turn out to look like this one.

Sources