Storm-0940 Breaches 2,250 Microsoft 365 Tenants in 3 Hours Using ARTEX Framework
Starting in September 2026, China-state-backed threat group Storm-0940 used the public AI agent penetration-testing framework ARTEX in a ConnectWise supply chain attack to launch automated attacks against more than 2,250 Microsoft 365 tenants, with some tenants going from initial targeting to privileged access in under three hours. Microsoft called the incident a milestone case of AI weaponization.