Executive Summary
In September 2026, the China-state aligned threat actor Storm-0940 integrated the open-source agentic AI framework ARTEX into their offensive workflows. This automation allowed the actor to scale operations exponentially, conducting reconnaissance, password spraying, and OAuth application abuse at machine speeds. Notably, the time from initial targeting to achieving privileged access was reduced to less than three hours in several cases, significantly narrowing the window for defensive response.
The campaign primarily targeted the ConnectWise Cloud Backup application, leveraging compromised third-party credentials to move laterally into over 2,250 downstream tenant environments. Once inside, the AI agents performed reconnaissance and established persistence by modifying application credentials and privileged roles. This activity allowed the actor to exfiltrate email and other sensitive data through Microsoft Graph without requiring interactive user logins.
This shift toward AI-accelerated attacks represents a critical escalation in threat actor capability, enabling sustained, high-volume operations that can overwhelm traditional manual SOC triaging. Organizations using multi-tenant applications must prioritize least-privilege configurations and monitor for anomalous service principal activity to mitigate these high-speed supply chain risks.