Microsoft Attributes Massive ConnectWise Credential Theft to China-Linked Storm‑0940 Using AI Tool ARTEX

Microsoft has released a technical briefing that ties a large‑scale compromise of ConnectWise Cloud services to a Chinese state‑aligned hacking group identified as Storm‑0940. The report details how the actors leveraged an artificial‑intelligence driven penetration‑testing platform named ARTEX to automate attacks against more than 2,250 Microsoft 365 tenant environments.

According to the findings, the group first harvested login credentials from ConnectWise’s cloud management suite. Using ARTEX, the stolen credentials were fed into a scripted process that scanned for vulnerable Microsoft 365 accounts and performed rapid, machine‑speed logins. The automation allowed Storm‑0940 to compromise a high volume of tenants in a short period, far exceeding the speed of traditional manual credential‑stuffing attacks.

The breach underscores a growing trend where threat actors combine stolen authentication data with AI‑enabled tools to amplify their reach. ARTEX, originally marketed as a legitimate security testing solution, appears to have been repurposed to conduct large‑scale reconnaissance and exploitation without human intervention. Security analysts note that the tool’s ability to adapt its attack patterns in real time makes detection more challenging for conventional defenses.

Microsoft’s investigation places the activity within the broader context of Chinese cyber‑espionage operations that have targeted cloud services for years. Storm‑0940, which the company describes as “state‑aligned,” is believed to operate under direction or tacit support from the Chinese government, though no official attribution has been made by any nation‑state. The group’s focus on Microsoft 365 aligns with prior campaigns that sought to harvest intellectual property, corporate communications, and other high‑value data stored in cloud platforms.

Following the disclosure, Microsoft has urged customers to reset any ConnectWise credentials, enable multi‑factor authentication, and review access logs for anomalous activity. The company also announced additional monitoring capabilities within its Defender for Cloud suite to flag AI‑driven attack patterns similar to those observed in the ARTEX operation. Industry observers say the episode may prompt a reassessment of how organizations vet third‑party security tools and manage credential hygiene across integrated SaaS environments.