{"schema_version":"0.8.0","id":"LR-2026-0235","record_version":4,"title":"Storm-0940 uses ARTEX agentic AI framework to automate cross-tenant password spraying and OAuth application abuse, including ConnectWise…","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-22","extraction_run_id":null},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":"ARTEX","tools_granted":["network scanning","password spraying","OAuth application abuse","Microsoft Graph","directory operations"],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"production","tier":null,"lifecycle_stage":null,"integration_type":"agentic_with_tools","intended_use":"agentic AI penetration testing framework used to automate scanning, reconnaissance, password spraying and OAuth application abuse","safeguard_state":null,"production_intended":null},"event":{"date_occurred":"2026-10-15","date_disclosed":"2026-10-22","incident_class":"security_compromise","failure_class":"credential_misuse","agent_involved":true,"secondary_failure_classes":["unauthorized_communication"],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"Microsoft said a China state-aligned actor it calls Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework, to speed up scanning and reconnaissance, password spraying and OAuth application abuse at downstream victims of the ConnectWise Cloud Backup supply chain compromise. On October 15, 2026, the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments. ConnectWise temporarily shut down services and is restoring them in phases.","tags":["supply-chain","password-spraying","oauth-abuse","nation-state","microsoft-365"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"The AI agents used stolen ConnectWise cloud application credentials to authenticate to customer environments and modified application credentials to establish persistence.","responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"major: The threat actor used the AI tool at machine speed to automate attacks targeting hundreds of organizations across the world, and ConnectWise shut down services.","harm_class":["third_party_security","operational"],"affected_description":"more than 2,250 tenants targeted; 327 accounts across eight organizations in the October 10-14 password spray; hundreds of organizations across sectors since September 2026","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html","publisher":"news search (Google News index)","date":"2026-10-22","type":"press","title":"China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"system.harness":"C","system.tools_granted":"D","system.integration_type":"D","system.intended_use":"C","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.date_occurred":"C","event.failure_class":"D","event.secondary_failure_classes":"D","event.tags":"D","event.adversarial_actor":"C","event.agent_involved":"C","event.summary":"C","event.incident_class":"D","event.date_disclosed":"A","event.trigger":"D","event.detection_method":"D","impact.harm_class":"D","impact.affected_description":"C","impact.severity":"D","context.shared_model_id":"C","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims."}],"system.harness":[{"source_index":0,"quote":"During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims."}],"system.tools_granted":[{"source_index":0,"quote":"In some of these cases, the AI agents are assessed to have progressed beyond authentication to Microsoft Graph and directory operations."}],"system.autonomy_level":[{"source_index":0,"quote":"\"Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to target environments through applications that had already been granted access, allowing the threat actor to operate without requiring an interactive user sign-in,\" Microsoft said."}],"system.deployment_context":[{"source_index":0,"quote":"That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments."}],"system.integration_type":[{"source_index":0,"quote":"During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims."}],"system.intended_use":[{"source_index":0,"quote":"During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims."}],"event.date_occurred":[{"source_index":0,"quote":"That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments."}],"event.failure_class":[{"source_index":0,"quote":"\"Additionally, after acquiring control of the identities of multiple ConnectWise cloud applications, the AI agents operating on behalf of the threat actor continued to use the same IP range to authenticate to customer environments using the illicit access acquired through these stolen app credentials, effectively taking advantage of the already established trust by these apps within a tenant,\" the tech giant added."}],"event.secondary_failure_classes":[{"source_index":0,"quote":"In some of these cases, the AI agents are assessed to have progressed beyond authentication to Microsoft Graph and directory operations."}],"event.tags":[{"source_index":0,"quote":"Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application."}],"event.adversarial_actor":[{"source_index":0,"quote":"Microsoft on Wednesday disclosed that a China state-aligned actor dubbed Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application."}],"event.incident_class":[{"source_index":0,"quote":"That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments."}],"event.agent_involved":[{"source_index":0,"quote":"That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments."}],"event.failure_class_detail":[{"source_index":0,"quote":"\"The application credential modification made by Storm-0940’s associated agents in the targeted victims' environments can lead to persistence through other identities, credentials, and cloud services,\" Microsoft said."}],"impact.affected_description":[{"source_index":0,"quote":"In the case of the ConnectWise incident, Storm-0940 has been observed using ARTEX to attempt to sign in to more than 2,250 tenants at 2,900 sign-in attempts per minute, a pace the company said gives defenders a short window to detect and respond."}],"impact.severity_because":[{"source_index":0,"quote":"The tech giant said the threat actor used the AI tool at \"machine speed\" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026."}],"impact.harm_class":[{"source_index":0,"quote":"ConnectWise, which temporarily shut down services following the attacks, has been restoring services in phases, a process that it said will take several days."}],"context.shared_model_id":[{"source_index":0,"quote":"During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims."}],"impact.severity":[{"source_index":0,"quote":"The tech giant said the threat actor used the AI tool at \"machine speed\" to automate attacks targeting hundreds of organizations across the world spanning a broad range of sectors since September 2026."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-22"}],"event.summary":[{"source_index":0,"quote":"During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims."},{"source_index":0,"quote":"That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments."},{"source_index":0,"quote":"ConnectWise, which temporarily shut down services following the attacks, has been restoring services in phases, a process that it said will take several days."}]},"notes_on_gaps":"No source states who first noticed the intrusion, so event.detection_method and story.caught are left unknown/null; the cited sentence about no successful authentication being detected concerns the October 10-14 spray, not detection of the intrusion. No source states a cause for the incident, so event.trigger is omitted. No source states a monetary loss figure, remediation hours, records exposed, or a third-party count as a number, so those impact fields are null. system.developer is unknown: no source names who built ARTEX or the DeepSeek model. system.model_version, permissions_scope, guardrails_present, safeguard_state, production_intended, lifecycle_stage, date_disclosed, date_detected, duration, time_to_contain, operations_paused, remediation, precursor_events, input_provenance, near_miss, and all context.regulatory/coverage/incident_evidence fields are not stated. system.autonomy_level full-auto is classified from Microsoft's statement that the actor operated without an interactive user sign-in; it is a grade-D inference about the agent arrangement. event.root_cause integration is classified from the description of stolen app identities exploiting pre-existing tenant trust; no source names a wiring or permission defect explicitly. impact.harm_class is classified from the service shutdown and the tenant compromise. context.systemic_exposure is classified from the MSP-path quote. event.date_disclosed and system.tier are derived by rule and not written. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-22] system.tools_granted: classified from described behaviour. system.integration_type: classified from described behaviour. system.developer: no source names the developer. system.autonomy_level: a source states no person was in the loop while it ran (not: silence about a human is not a statement that none was there). system.deployment_context: classified from described behaviour. event.secondary_failure_classes: a source states the agent contacted a system, person or service outside its permitted scope (not: data carried out by the contact is data_exfiltration). event.tags: classified from described behaviour. event.responsible_party: third_party. event.summary: classified from described behaviour. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached (not: an agent acting on a goal of its own with no external cause is agent_misalignment; a wrong action with no adversary and no breach is operational_error). event.trigger: no source states a cause. event.detection_method: no source says who first noticed. impact.harm_class: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location. [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a value cited to a sentence about a different event or company was cleared; citations to sentences about a different event were removed; summary or story described a different event or the article, not this event] [corrected by Srini Iyer, approved 2026-10-22 in the corrections review: a judgement inferred by us that no source states was cleared]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":"ARTEX","upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"ARTEX, an agentic AI penetration-testing framework configured with DeepSeek and other models, was used by the China state-aligned actor Storm-0940 to automate reconnaissance, password spraying and OAuth application abuse against hundreds of organizations, including ConnectWise cloud applications and Microsoft 365 tenants.","quote":"During the incident, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework that was made closed-source in the wake of its abuse in cyber attacks targeting South Korean financial institutions, to speed up scanning and reconnaissance, password spraying, and OAuth application abuse at downstream victims.","source_index":0,"grade":"D"},{"step":"went_wrong","text":"The AI agents used stolen identities of ConnectWise cloud applications to authenticate to customer environments and modified application credentials to establish persistence, crossing the boundary of the tenants they were not authorized to access.","quote":"That changed on October 15, 2026, when the AI agents gained access to the identities of multiple ConnectWise cloud applications and began to use them to authenticate to customer environments.","source_index":0,"grade":"D"},{"step":"reached","text":"The agents reached Microsoft 365 and Exchange Online tenants, Microsoft Graph and directory operations, and modified identities, groups and privileged roles in victim environments; more than 2,250 tenants were targeted.","quote":"In some of these cases, the AI agents are assessed to have progressed beyond authentication to Microsoft Graph and directory operations.","source_index":0,"grade":"D"},{"step":"done","text":"ConnectWise temporarily shut down services following the attacks and is restoring them in phases over several days; Microsoft disclosed the campaign and attributed it to Storm-0940.","quote":"ConnectWise, which temporarily shut down services following the attacks, has been restoring services in phases, a process that it said will take several days.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-22","source_urls":["https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html"]}}