Case storm-0940-artex-connectwiseState actor AI opsWorldwide
Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise
Microsoft reports a large-scale nation-state campaign in which Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise and abuse application credentials in Microsoft 365.
HighAttack using AIStatus: Under investigationVerified case file
Open in the interactive mapCite this case
- Reported
- Oct 21, 2026
- Location
- Worldwide
- Target
- ConnectWise customers and Microsoft 365 environments
- Severity
- High
- Verification
- Reported by credible press or researchers
- Triggered by
- Storm-0940
- Actor type
- State-sponsored
- Sector
- Multiple / cross-sector
- Reported loss
- None reported
- CVE
- None
What happened
Microsoft reports a large-scale nation-state campaign in which Storm-0940 used ARTEX agentic AI to accelerate a ConnectWise supply chain compromise and abuse application credentials in Microsoft 365.
Impact: Described as large-scale; application credentials were abused across Microsoft 365 environments. Number of victims not stated.
Who triggered it
Actor: Storm-0940
Attribution: Microsoft Security Blog attributes the campaign to Storm-0940 and describes it as nation-state activity.
Motive: Unknown
How it happened
Attack vector: ConnectWise supply chain compromise accelerated by ARTEX agentic AI, then application credential abuse across Microsoft 365.
Root cause: Unknown
Timeline
- Reported by Microsoft Security Blog
Response
Microsoft published its analysis of the campaign. Further response details are not given.
Current status: Under investigation
Research warnings this case matches
- Seen in real incidents AI makes cyberattacks easier, faster and larger · CAIS
- Seen in real incidents Criminals and state hackers use AI in cyberattacks · International AI Safety Report
- Seen in real incidents Malicious actors and misuse · MIT AI Risk Repository
Compared with published AI risk research from several institutes on the Research vs reality page.
Sources (open in a new tab)
- Microsoft Security Blog microsoft.com
- Microsoft Security Blog microsoft.com
Cite this case
Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise. AI Threat Watch, case storm-0940-artex-connectwise, Oct 21, 2026. https://aithreat.io/cases/storm-0940-artex-connectwise/
Permanent link: https://aithreat.io/cases/storm-0940-artex-connectwise/
Related cases
The same type of incident, most recent first.