As cited
Copy frozen at (site build).
threat intel
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940, a China-state aligned actor, leveraged ARTEX, an open-source agentic artificial intelligence (AI) penetration testing framework, to automate large-scale attacks against hundreds of organizations starting in September 2026. The actor exploited the ConnectWise supply chain compromise in October 2026 to gain privileged cloud access in multiple customer environments, with some intrusions achieving that objective in under 3 hours. ARTEX enabled the threat actor to accelerate reconnaissance, password spraying, and OAuth application abuse at machine speed, generating high-volume authentication attempts and creating minimal time for defenders to respond.
Why it matters: Organizations using ConnectWise Cloud Backup and other affected multi-tenant applications must immediately disable those connections, preserve forensic evidence, and search for unauthorized service principal activity and Microsoft Graph operations in their Microsoft 365 tenants from October 1 onward, as compromised OAuth apps can enable persistent backdoor access even after remediation of the original application.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940, a China-state aligned actor, leveraged ARTEX, an open-source agentic artificial intelligence (AI) penetration testing framework, to automate large-scale attacks against hundreds of organizations starting in September 2026. The actor exploited the ConnectWise supply chain compromise in October 2026 to gain privileged cloud access in multiple customer environments, with some intrusions achieving that objective in under 3 hours. ARTEX enabled the threat actor to accelerate reconnaissance, password spraying, and OAuth application abuse at machine speed, generating high-volume authentication attempts and creating minimal time for defenders to respond.
Why it matters: Organizations using ConnectWise Cloud Backup and other affected multi-tenant applications must immediately disable those connections, preserve forensic evidence, and search for unauthorized service principal activity and Microsoft Graph operations in their Microsoft 365 tenants from October 1 onward, as compromised OAuth apps can enable persistent backdoor access even after remediation of the original application.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940, a China-state aligned actor, leveraged ARTEX, an open-source agentic artificial intelligence (AI) penetration testing framework, to automate large-scale attacks against hundreds of organizations starting in September 2026. The actor exploited the ConnectWise supply chain compromise in October 2026 to gain privileged cloud access in multiple customer environments, with some intrusions achieving that objective in under 3 hours. ARTEX enabled the threat actor to accelerate reconnaissance, password spraying, and OAuth application abuse at machine speed, generating high-volume authentication attempts and creating minimal time for defenders to respond.
Why it matters: Organizations using ConnectWise Cloud Backup and other affected multi-tenant applications must immediately disable those connections, preserve forensic evidence, and search for unauthorized service principal activity and Microsoft Graph operations in their Microsoft 365 tenants from October 1 onward, as compromised OAuth apps can enable persistent backdoor access even after remediation of the original application.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940, a China-state aligned actor, leveraged ARTEX, an open-source agentic artificial intelligence (AI) penetration testing framework, to automate large-scale attacks against hundreds of organizations starting in September 2026. The actor exploited the ConnectWise supply chain compromise in October 2026 to gain privileged cloud access in multiple customer environments, with some intrusions achieving that objective in under 3 hours. ARTEX enabled the threat actor to accelerate reconnaissance, password spraying, and OAuth application abuse at machine speed, generating high-volume authentication attempts and creating minimal time for defenders to respond.
Why it matters: Organizations using ConnectWise Cloud Backup and other affected multi-tenant applications must immediately disable those connections, preserve forensic evidence, and search for unauthorized service principal activity and Microsoft Graph operations in their Microsoft 365 tenants from October 1 onward, as compromised OAuth apps can enable persistent backdoor access even after remediation of the original application.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940, a China-state aligned actor, leveraged ARTEX, an open-source agentic artificial intelligence (AI) penetration testing framework, to automate large-scale attacks against hundreds of organizations starting in September 2026. The actor exploited the ConnectWise supply chain compromise in October 2026 to gain privileged cloud access in multiple customer environments, with some intrusions achieving that objective in under 3 hours. ARTEX enabled the threat actor to accelerate reconnaissance, password spraying, and OAuth application abuse at machine speed, generating high-volume authentication attempts and creating minimal time for defenders to respond.
Why it matters: Organizations using ConnectWise Cloud Backup and other affected multi-tenant applications must immediately disable those connections, preserve forensic evidence, and search for unauthorized service principal activity and Microsoft Graph operations in their Microsoft 365 tenants from October 1 onward, as compromised OAuth apps can enable persistent backdoor access even after remediation of the original application.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
Storm-0940, a China-state aligned actor, leveraged ARTEX, an open-source agentic artificial intelligence (AI) penetration testing framework, to automate large-scale attacks against hundreds of organizations starting in September 2026. The actor exploited the ConnectWise supply chain compromise in October 2026 to gain privileged cloud access in multiple customer environments, with some intrusions achieving that objective in under 3 hours. ARTEX enabled the threat actor to accelerate reconnaissance, password spraying, and OAuth application abuse at machine speed, generating high-volume authentication attempts and creating minimal time for defenders to respond.
Why it matters: Organizations using ConnectWise Cloud Backup and other affected multi-tenant applications must immediately disable those connections, preserve forensic evidence, and search for unauthorized service principal activity and Microsoft Graph operations in their Microsoft 365 tenants from October 1 onward, as compromised OAuth apps can enable persistent backdoor access even after remediation of the original application.
- Source published
- First seen by Cybersecurity Tracker