According to a report published by Microsoft, the China-linked hacking group Storm-0940 used ARTEX to automate intrusion attempts against hundreds of organizations worldwide, reaching more than 2,250 tenants. In some cases, the attacks obtained elevated privileges in less than 3 hours.
Storm-0940 is reported to have used the AI penetration-testing tool ARTEX to carry out large-scale automated attacks targeting customers' cloud environments. The targets spanned a wide range of industries worldwide, and the group has reportedly been active since 2021.
The attacks began with the hijacking of ConnectWise's cloud application and also targeted Microsoft 365 customer environments. Between 10 and 14 October 2026, the attackers conducted automated password spraying across 327 accounts, resulting in more than 151,000 failed logons being detected.
The peak rate was 2,900 sign-in attempts per minute, with approximately 111,000 failures concentrated in a single day. Most attempts led to account lockouts, and no successful authentications were confirmed.
ARTEX is originally a penetration-testing tool, but in the hands of attackers it can attempt intrusions through multiple pathways at machine speed. Storm-0940 is reported to have used ARTEX to reach more than 2,250 tenants.
Attacks using ARTEX have also been reported in Japan, and a number of Japanese companies targeted in these incidents have disclosed information leaks. Defenders continue to face a situation in which the speed of their response is critical.