Description: Microsoft reported that China-aligned hackers used ARTEX, an AI penetration-testing framework, to access customers' Microsoft 365 environments through stolen credentials for ConnectWise's cloud backup services. Agents reportedly changed credentials and privileges in some environments to retain unauthorized access. The activity formed part of a global campaign; the extent of compromise and any data theft remained uncertain.
Entities
View all entitiesAlleged: Large language model developers , ARTEX developers and AI agent system developers developed an AI system deployed by Threat actors , Storm-0940 , China-linked threat actors , AI agent system deployers and Agentic threat actors, which harmed Microsoft , Enterprises relying on Microsoft 365 and identity services , ConnectWise customers , ConnectWise and Information integrity.
Incident Stats
Incident ID
1781
Report Count
2
Incident Date
2026-10-15
Editors
Daniel Atherton
Incident Reports
Reports Timeline
Loading...
As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks targeting hundreds of organizations globally across a broad range of industries. Several of the…
Loading...
Oct 21 (Reuters) - A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organizations globally, Microsoft said on Wedne…
Variants
A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?
Similar Incidents
Did our AI mess up? Flag the unrelated incidents
Similar Incidents
Did our AI mess up? Flag the unrelated incidents