ARTEX: China-Linked Hackers Aimed an AI Pentest Framework at 2,250+ Tenants

Two of the largest threat intelligence teams have now documented the same open-source AI framework at the centre of state-aligned hacking campaigns. On 21 October 2026, Microsoft said it assesses that Storm-0940 was responsible for the ConnectWise supply chain compromise. It describes Storm-0940 as a China-state aligned actor using the "agentic AI penetration testing framework ARTEX", and says it attempted sign-ins to more than 2,250 tenants. Eight days later, CrowdStrike reported that a separate China-nexus group, VAPOR PANDA, used ARTEX against more than 200 organisations in at least 14 countries in 11 days. This is the point where "AI-assisted attacks" stopped being a slide in a vendor deck and became a hunting query.

What ARTEX is

Microsoft describes ARTEX as an open-source, multi-agent LLM penetration testing system written in Go with a Next.js front end. It can use any model, runs from reconnaissance through exfiltration with little human input, and stores discovered assets and vulnerabilities in a graph that the agents share. Its interface ships in English, Korean, Mandarin, Spanish and Japanese.

BleepingComputer reports that the framework was built by Chinese developers and initially released as open source, then made proprietary after real-world attacks. Cyber Security News says the original GitHub repository went up in July 2026 and came down in October, with copies still circulating. In other words, the tool is out, and pulling the repo did not put it back in the box.

What happened: Storm-0940 and ConnectWise

ConnectWise published its first advisory on 16 October 2026 after a compromise affecting its cloud applications, including ConnectWise Cloud Backup. Microsoft's analysis says Storm-0940 acquired control of the identities of multiple ConnectWise cloud applications, then used ARTEX agents to reuse the access those apps already had in customer tenants. Microsoft says this let the actor operate without an interactive user sign-in.

From there the agents ran reconnaissance, credential changes and privilege modification attempts through Microsoft Graph, with agents that Microsoft notes can try several breach paths at once and work around the clock. In multiple cases, time from first targeting to privileged access was "less than 3 hours".

A related password-spray campaign from 10 to 14 October generated more than 151,000 failed logons against 327 accounts at eight organisations, peaking at about 2,900 failures per minute. Microsoft says it saw no successful authentication in that spray dataset, and nearly 98% of the responses were lockouts. That is the useful nuance: the agents are fast and tireless, and they also fail loudly.

What happened: VAPOR PANDA

CrowdStrike's 29 October post describes a different group with the same toolkit. Starting on 17 October, VAPOR PANDA used ARTEX mainly on DeepSeek, plus a second commercial model CrowdStrike could not confirm. One human operator ran several engagements at once, stepping in at decision points with instructions in Chinese. Agents pursued parallel paths across web apps, cloud, containers, Active Directory and VPNs.

The techniques were familiar: an unsigned SAML assertion combined with XXE to reach cloud metadata, LAPS password reads, constrained delegation abuse, a mail server admin token forged from keys in a 2022 directory export, and VPN configs from a 2024 email leak. CrowdStrike confirmed post-exploitation and BLOODALCHEMY backdoor deployment at nine organisations. Agents were even told to find "Windows machines in the domain without Falcon", which is a pointed compliment to EDR coverage.

The numbers

Why it matters

The ConnectWise case is a supply chain story about identity, not code. A multi-tenant SaaS app with broad Graph permissions is a pre-authorised doorway into every customer that consented to it. ARTEX did not invent that risk. It made walking through 2,250 doorways cheap. I wrote about this class of problem in the non-human identity post: service principals and OAuth grants are the credentials that nobody rotates and few people watch.

What sceptics say

The 2,250 figure is attempted access, not 2,250 breaches. Microsoft is explicit about that, and the spray campaign it measured produced no successful logins at all. CrowdStrike's confirmed count is nine organisations out of 200 targeted. DIVD, which said in a LinkedIn post cited by BleepingComputer that ARTEX was the tool used against its network, called the activity "super loud and messy". The fair reading is that agentic frameworks raise volume and persistence enormously while still relying on old weaknesses: unrotated keys, unsigned SAML, leaked VPN configs, missing EDR. There is also no public number on how much of the work the model did versus the operator, beyond CrowdStrike's description of human intervention at decision points.

What it means for engineering and DevOps teams

My view (opinion): treat third-party multi-tenant apps as production credentials you happen not to hold. This quarter I would:

• Inventory enterprise apps by application ID, not display name, as Microsoft recommends, and review their Graph permissions and consent grants.
• Alert on credential additions to service principals and on app-only activity from unusual locations.
• Rotate long-lived signing keys, including those that may sit in old exports and backups. CrowdStrike's mail token forgery came from a 2022 export.
• Enforce SAML signature validation and IMDSv2, and limit what cloud roles can do from instance metadata.
• Cover every server with EDR, including internal ones. The agents were explicitly hunting for hosts without it.
• Hunt for ARTEX markers CrowdStrike published, such as artx prefixed cloud roles and the C:\ProgramData\artx5v\ directory.

If you run vendor apps like ConnectWise, Microsoft's advice is to keep affected connections disabled until the vendor gives restoration steps, and not to delete the enterprise apps first, since that destroys evidence. For the wider picture of where AI fits on the defensive side, see AI SOC agents in 2026.

FAQ

What is ARTEX AI?

ARTEX is a multi-agent AI penetration testing framework, written in Go, that can drive any LLM through reconnaissance, exploitation and exfiltration with a shared graph of findings. It was released as open source and has since been used by at least two China-linked groups, according to Microsoft and CrowdStrike.

Was ConnectWise hacked by AI?

Microsoft assesses that Storm-0940 was responsible for the ConnectWise compromise and says the actor used ARTEX to accelerate abuse of the compromised apps across customer tenants. The initial compromise and the agentic follow-on activity are described together; Microsoft does not say the AI performed the initial breach alone.

Which AI model did the attackers use?

CrowdStrike says VAPOR PANDA relied mainly on DeepSeek plus a second commercial model it could not confirm. Microsoft notes that ARTEX can use any model and did not name one for Storm-0940.

Related: Who Is This Agent? Non-Human Identity in 2026, From the RFCs to the Breaches, AI SOC Agents in 2026: 98% Accuracy Claims, 23 to 34% on the Benchmark, and 0% of Teams Letting Them Act Alone and Top Cloud Security Misconfigurations in 2026: 59% Still Have Old Keys.