Microsoft Threat Intelligence reports that Storm-0940, a China-state aligned actor, used an open-source multi-agent AI penetration-testing framework called ARTEX to run autonomous attacks against hundreds of organizations starting around September 2026. Microsoft assesses the group used stolen credentials for a multi-tenant cloud backup application to compromise more than 2,250 ConnectWise tenants, with some intrusions gaining privileged cloud access within three hours. The company says most of the targeting did not succeed, and that application access alone does not confirm data was taken.
