Microsoft disclosed on October 21, 2026 that Storm-0940, a China-state aligned hacking group, used an agentic AI penetration-testing framework called ARTEX to automate reconnaissance and password-spraying against Microsoft 365 accounts, then compromised ConnectWise Cloud Backup customers’ environments around October 15. The AI agents went beyond authentication in some environments, modifying credentials, identities, groups, and privileged roles to establish persistent access. The campaign reached over 2,250 tenants at up to 2,900 sign-in attempts per minute and targeted hundreds of organizations across technology, finance, government, defense, and other sectors globally; Microsoft said it could not confirm how much data, if any, was exfiltrated.