ARTEX AI Agents Reportedly Used Stolen Cloud Backup Credentials to Access ConnectWise Customers' Microsoft 365 Environments

Microsoft reported that China-aligned hackers used ARTEX, an AI penetration-testing framework, to access customers' Microsoft 365 environments through stolen credentials for ConnectWise's cloud backup services. Agents reportedly changed credentials and privileges in some environments to retain unauthorized access. The activity formed part of a global campaign; the extent of compromise and any data theft remained uncertain.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The incident involved state-aligned threat actors using an autonomous AI penetration testing framework to conduct rapid, large-scale cyberattacks against critical infrastructure and organizations.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was initiated by human threat actors (Storm-0940) who intentionally deployed the ARTEX AI framework to conduct malicious cyberattacks.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The AI system was used to automate attacks targeting critical infrastructure sectors, including energy, financial services, and defense, which has significant implications for public safety and security.

AI system and alleged parties

• AI system: None named
• AI purpose: Target Identification; Automatic Fault Handling
• Behaviour type: Multi-agent
• Alleged developer: Large language model developers, ARTEX developers, AI agent system developers
• Alleged deployer: Threat actors, Storm-0940, China-linked threat actors, AI agent system deployers, Agentic threat actors
• Alleged harmed parties: Microsoft, Information integrity, Enterprises relying on Microsoft 365 and identity services, ConnectWise customers, ConnectWise

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Minor, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Infrastructure

Reported: The report explicitly describes unauthorized access and credential modifications in cloud infrastructure.

Directly caused: The AI system automated attacks that compromised cloud infrastructure, obtaining privileged access in less than 3 hours and modifying credentials across multiple customer environments.

Inferred additional harm: It is likely that the compromised cloud infrastructure led to operational disruptions for the hundreds of affected organizations, though specific details of downtime are not provided.

Privacy

Reported: The report explicitly describes potential unauthorized access to customer environments and data, though exfiltration was not confirmed.

Directly caused: The AI agents obtained privileged access to cloud environments and Microsoft Graph, which contains sensitive organizational and user data.

Inferred additional harm: Given that privileged access was obtained at many organizations, it is highly likely that sensitive corporate or personal data was exposed or accessed during the persistence phase.

People affected

• Occurrences reported: 1
• People reportedly exposed: 2577

Potential causes

Management

• Inadequate AI Risk Assessments: Organizations failed to assess risks of AI-driven supply chain attacks.
• Poor Privilege Governance: Management failed to enforce least-privilege policies for third-party apps.
• Lack of AI Posture Monitoring: No centralized oversight of AI assets and agentic risks in the enterprise.

Technology

• Autonomous LLM Penetration Testing: ARTEX automates full attack chains from recon to exfiltration at machine speed.
• AI-Accelerated Multi-Agent Workflows: Multi-agent systems execute concurrent attack paths, reducing breach times.
• Lack of AI Abuse Guardrails: Open-source ARTEX framework allows any LLM to be used for offensive tasks.

Data Inputs

• Stolen OAuth App Credentials: AI agents used compromised credentials to bypass interactive user sign-ins.
• High-Volume Telemetry Noise: AI-driven automated actions generate massive logs that mask malicious intent.
• Abused Multi-Tenant Access Tokens: AI leveraged existing trusted app tokens to query Microsoft Graph APIs.

Human Factors

• Defender Cognitive Overload: Rapid machine-speed attacks leave defenders insufficient time to respond.
• Minimal Human Intervention Needed: AI agents operate autonomously without requiring active human operators.
• Over-Reliance on Trusted Apps: Users trusted ConnectWise backup app, overlooking anomalous API activities.

Process and Methods

• Inadequate Real-Time AI Detection: Traditional security monitoring processes failed to block rapid AI attacks.
• Slow Incident Response Processes: Human-in-the-loop response processes cannot match machine-speed exploits.
• Excessive App Permissions Granted: Multi-tenant apps were granted overly broad privileges, easing AI movement.

Regulatory Environment

• Unregulated Dual-Use AI Software: Lack of legal controls on open-source autonomous offensive AI systems.
• Absence of Agentic AI Standards: No regulatory oversight on safety guardrails for agentic LLM deployments.

Information quality

• Classification confidence: High
• Reason for confidence: The reports from Microsoft and Reuters provide highly detailed, technical, and consistent accounts of the incident, including specific timelines, tactics, techniques, and indicators of compromise. The role of the AI system (ARTEX) is explicitly defined as an agentic framework used to automate the attacks.
• Ambiguities identified: Whether customer data was actually exfiltrated remains unconfirmed, as Microsoft notes the presence of the application does not necessarily indicate data access.
• Alternative interpretations: None. The incident is clearly a state-aligned cyber campaign leveraging an AI-driven automation framework.

A China-aligned threat actor used the autonomous multi-agent AI framework ARTEX to conduct rapid cyberattacks against critical sectors globally. By executing reconnaissance and establishing backdoors in less than 3 hours, the incident highlights how agentic AI accelerates cyber threats to machine speed, posing substantial risks to critical infrastructure, defense intelligence, and economic security.

• Overall national security impact: Substantial
• Scope: Multiple nations
• Primary target: No clear primary
• Other affected: Global organizations in aerospace, defense, energy, and financial sectors
• Alleged perpetrator: China-aligned threat actor Storm-0940

Threat characteristics

• Imminence: Near-term. The active backdoors and ongoing remediation efforts require active monitoring and security reviews over the next 30 days.
• Autonomy: Full autonomy. The ARTEX framework deployed autonomous AI agents that conducted reconnaissance, credential abuse, and privilege escalation with little to no human intervention.
• Novelty: Evolved capability. Represents a significant advancement in cyber warfare, moving from traditional automated scripts to dynamic, LLM-driven multi-agent offensive frameworks.

Impact by dimension

• Physical security: Substantial. Threat actor targeted critical infrastructure sectors including energy, aerospace, and defense. While no physical damage was reported, the AI-driven establishment of backdoors in these sectors represents a substantial threat.
• Information security: Substantial. A state-aligned actor successfully compromised cloud infrastructure and established backdoors in aerospace and defense organizations, threatening sensitive intelligence and proprietary technical data.
• Sovereignty: Minor. The campaign targeted private and commercial defense and energy entities globally rather than directly compromising core government decision-making or electoral processes.
• Economic security: Substantial. The use of agentic AI to execute attacks at machine speed threatens technological competitiveness and critical financial services, leaving defenders with insufficient response time.
• Societal stability: Negligible. No significant threats to societal stability, civil liberties, or mass surveillance of populations were reported in this incident.