#artex

October 25, 2026

Storm-0940 drove the ConnectWise intrusions with the open-source AI pentest framework ARTEX at machine speed. Microsoft says the China-linked actor hit over 300 accounts across eight organisations at more than 2,900 attempts per minute, then used ARTEX to attempt sign-ins to more than 2,250 tenants, generating 151,000+ failed logon events. In some environments the agents progressed past authentication into Microsoft Graph and directory operations — reconnaissance, application credential modification for persistence, and changes to identities, groups and privileged roles, ensuring access survives remediation of the original app. (SecurityWeek) · Threat Activity
A practitioner write-up on how LLM-based pentest harnesses actually work — the agent loop, tool wiring, and where these frameworks break down — useful context for anyone evaluating or defending against ARTEX-class tooling. (Utku Şen) · New Tools & Releases

October 22, 2026

Microsoft now assesses that China-aligned Storm-0940 conducted the ConnectWise Cloud Backup compromise using ARTEX. Since September, the actor targeted hundreds of organizations globally; several attacks reached privileged cloud access, and multiple did so in under three hours. ARTEX used compromised, previously consented application credentials to enter Microsoft 365 without an interactive sign-in, followed by Graph reconnaissance, credential changes and privilege attempts. Successful authentication does not itself prove data access or exfiltration. The attribution and agentic workflow are new since earlier coverage; see Microsoft’s analysis. · Cloud, Identity & Threat Activity