Chinese state-aligned hackers wield autonomous AI penetration framework to breach ConnectWise clients

A China-aligned threat group identified by Microsoft as Storm-0940 breached IT software vendor ConnectWise and weaponized stolen application credentials against thousands of downstream corporate environments. The hackers utilized ARTEX, an open-source AI penetration testing framework, to orchestrate autonomous sign-in attempts targeting more than 2,250 Microsoft 365 tenants. In some affected systems, the intruders escalated to privileged access within three hours. [2][3]

The automated framework accelerated reconnaissance, credential abuse, and rapid-fire login attempts, reaching peak speeds of roughly 2,900 requests per minute. Once inside specific customer tenants, the agents altered directory settings and assigned administrative roles. In response, ConnectWise temporarily suspended several offerings, including Cloud Backup, SaaS Security, and Cloud Management, while initiating a phased system recovery. [2][3]

The incident highlights mounting concerns over autonomous offensive tools, with Microsoft warning that agentic AI limits the time defenders have to detect intrusions. The same ARTEX tool was recently linked to intrusions affecting South Korean financial institutions, and its developer subsequently announced on GitHub that the codebase would shift to closed source. [2][3]