Microsoft says a China-aligned group used an open-source agent framework to hit 2,250+ Microsoft 365 tenants at 2,900 sign-in attempts a minute after the ConnectWise breach — in some cases gaining privileged access in under 3 hours
Microsoft Threat Intelligence has attributed the ConnectWise supply-chain attack to Storm-0940, a China-state-aligned actor, which used ARTEX — an open-source agentic AI penetration-testing framework — to attempt sign-ins on more than 2,250 Microsoft 365 tenants at up to 2,900 attempts per minute. In several cases the AI agents went from initial targeting to privileged cloud access in under three hours. It is being described as one of the first publicly documented nation-state intrusions executed by AI agents — a watershed for AI-powered cyberattacks, showing machine-speed operations against supply-chain trust.
SOURCES
- Kim2026-10-22 08:20