## AI Accelerates Global Hacking Campaign **Microsoft** has been actively investigating **Storm-0940**, a threat actor that has used the **ARTEX** AI penetration testing framework to breach cloud infrastructure across diverse sectors since September. Targets have included government, aerospace, defense, finance, manufacturing, technology, and energy industries. After initial access, the hackers conducted reconnaissance, acquired credentials, and attempted privilege escalation for expanded data collection. What makes this campaign particularly alarming is the rapid pace enabled by AI, with threat actors often achieving privileged access in under three hours from initial targeting. “While the majority of the targeting wasn’t successful, **Storm-0940** achieved privileged cloud persistence at many organizations in a brief time,” **Microsoft** stated in their analysis. **Storm-0940**, active since 2021, primarily focuses on data theft, targeting internet-facing applications and leveraging compromised accounts to expand access. ## The Rise of ARTEX **ARTEX** is an open-source penetration testing tool, released on **GitHub** earlier this year by an account known as "Autumn-27." It enables users to deploy AI models to automate offensive security actions, coordinating a team of agents to “run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction,” as explained by **Microsoft**. The tool has recently been linked to multiple attacks on South Korean and Japanese financial institutions, as reported by **CrowdStrike** and other outlets. **Zscaler** researchers further corroborated these findings, reporting that **ARTEX**-backed attacks extended far beyond South Korea, impacting numerous industries across various countries. Li Puhua, a Chinese cybersecurity engineer identified as the developer of **ARTEX**, issued a statement on **GitHub** on October 8, asserting that the tool was designed for learning and research and was being misused by malicious actors. He announced that the project would no longer be updated and would be converted to closed source, with no further public releases or maintenance support. Chinese Foreign Ministry spokesperson Mao Ning denied any knowledge of these incidents during a recent press briefing. ## ConnectWise Supply Chain Attack: A Case Study in AI-Driven Speed Over the past weekend, **ConnectWise** was compelled to suspend several services following warnings from **Microsoft** and other cybersecurity firms regarding a supply-chain attack affecting its Cloud Backup service. This service is designed to protect data within **Microsoft 365** and **Google Workspace** environments. Attackers exploited stolen Cloud Backup credentials to gain broad access to systems where the application was installed. **Microsoft** confirmed that **Storm-0940** utilized **ARTEX** to accelerate the “speed of compromised application abuse to authenticate to **Microsoft 365** customer environments through applications that had already been granted access.” “This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,” **Microsoft** cautioned. “Agents are not constrained by factors affecting humans — they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks like supply chain compromises.” The **ConnectWise** incident saw an astonishing 2,900 sign-in attempts per minute, a pace that overwhelms human defenders. On October 11 alone, over 111,000 failed log-on attempts were recorded. **Microsoft** noted that the campaign combined broad, low-rate account spraying with sustained, high-volume authentication attempts against selected identities, leading to nearly 98% of all activity being lockout responses. The campaign was linked to **Storm-0940** through publicly reported IP addresses from **ConnectWise** that matched **Microsoft**'s own investigation data.