SPR{K}3back to research

An AI pentest framework just got into a software supply chain at machine speed

October 24, 2026 · SPR{K}3 Research

On October 21, 2026, Microsoft Threat Intelligence attributed a successful supply-chain compromise of ConnectWise Cloud Backup to Storm-0940, a China-state-aligned actor it has tracked since November 2024. The toolchain was unusual: the attacker drove the operation with ARTEX, an open-source Go-based agentic AI penetration-testing framework that automates scanning, reconnaissance, password spraying, and OAuth application abuse. The tempo was the headline. The persistence is the problem.

What happened

Between October 10 and October 14, Microsoft recorded a password-spraying campaign from 144.172.64[.]99 against 327 accounts across eight organizations, aimed at Microsoft 365 and Exchange Online. More than 151,000 failed logons went into the record. The peak was October 11 at 2,900 attempts per minute, with over 111,000 failures that day. Forty-eight accounts saw more than 1,000 failures each. No successful authentication, token issuance, Graph call, or directory change was observed during that spray window.

Then on October 15, Storm-0940 gained control of identities for several ConnectWise cloud applications and used them to authenticate to customer environments. From there the agents did Microsoft Graph reconnaissance, directory operations, application credential changes for persistence, and modifications to identities, groups, and privileged roles.

Microsoft says ARTEX has been used "at machine speed" against hundreds of organizations since September 2026, and that some ARTEX-driven intrusions have reached privileged cloud access in under three hours from initial targeting. Microsoft also warned that application credential changes "can remain active as a backdoor even after the original compromised application is [re]mediated."

Zscaler ThreatLabz found that Storm-0940's ARTEX deployment was configured to use a DeepSeek model through an OpenAI-compatible gateway, with alternate deployments pointing at DeepSeek, GLM, and Grok. Prompts had the models divide investigation tasks and review each other's findings.

ConnectWise's own statement said the activity "describes a campaign that reaches well beyond any one company, noting that one trusted connection can expose many organizations." The company temporarily shut down services and is restoring them in phases.

This is the second ARTEX reading in October

CrowdStrike disclosed an earlier ARTEX wave on October 7 against Shinhan Bank, KB Kookmin Bank, and Hana Bank in South Korea. Recorded Future's Insikt Group tracks the parallel cluster as TAG-217, with activity back to August 17, 2026. Different cluster, different attribution, same framework.

So the public record now has:

The pattern that matters here is not that criminals use AI. It is that one open-source agentic framework is now the shared substrate for multiple nation-state-attributed operations, and the operator's own backing model is a rotatable configuration choice, not a fixed property of the tooling.

Three things this incident actually shows

One: the compromise did not need any new vulnerability. No CVE was named. The spray phase did not succeed on any one account; it succeeded on the aggregate. The agents did at 2,900 attempts per minute what a human operator could not sustain at any price. Then ARTEX picked up the ConnectWise cloud application identities, and those identities already had the authentication primitives the agents needed to pivot into customer environments. The failure mode here is tempo, not patch cadence.

Two: the persistence is in the application identity, not on the host. Microsoft explicitly warned that application credential changes stay active as a backdoor after remediation. ConnectWise can disable the compromised application; the credentials the attacker wrote into Entra ID while they had the keys outlive that disablement. For an enterprise that trusted ConnectWise through a federation relationship, the question is no longer "is the ConnectWise application still compromised" — it is "which application credentials in our own tenant were changed between October 15 and now."

Three: the model backend is the attacker's dial. Storm-0940's ARTEX deployment ran against DeepSeek through an OpenAI-compatible gateway, with alternate configurations for DeepSeek, GLM, and Grok. The operator can swap providers to evade per-provider usage telemetry, and the "divide tasks and review each other's findings" prompt pattern is explicitly multi-model. Any defender posture that assumes attacker-side AI use will be observable at one named provider's abuse-monitoring tier is a posture built against a dial that already turns.

What has to catch this

A nation-state operator driving 2,900 failed logons per minute through a cloud identity provider is a tempo problem. The defender does not out-type the agents, out-rotate the models, or out-remediate the compromised application identities one at a time. Three things change the calculus:

The runtime observable has to live outside the agent. The attacker's agents are doing what their operator told them to do; model-side alignment is irrelevant to Storm-0940's prompt pattern. What the enterprise defender needs is machine-speed detection of the behavioral sequence — spray at 2,900/min, then application identity takeover, then cross-tenant Graph reconnaissance — at the point where it crosses the identity-federation boundary, not at the point where any one request looks suspicious.

Application identity has to be treated as the persistence tier. The "application credential changes can remain active" warning is architectural, not advisory. Every federated application an enterprise trusts becomes a cross-tenant persistence substrate the moment that application's publisher is compromised. The remediation question is not "has the vendor patched" but "which of our own tenant's application credentials were written during the vendor's compromise window."

The attacker's model backend is not the defender's observable. The defender who assumes the attacker's model-side policy will catch the attack has delegated the control plane to someone whose budget is denominated in attacker ROI. Behavior at the enterprise-tenant boundary is what the enterprise can see, regardless of which model the attacker is running.

The takeaway

Agentic AI pentesting frameworks are now a nation-state tool stack with named numerators. The ConnectWise compromise is not a new vulnerability class; it is the old supply-chain-trust class running at a tempo the human-paced defender posture was not built against, with persistence primitives (application credentials in federated identity) that outlive the vendor's own remediation. The attacker's model backend is a configuration choice. The enterprise's observable has to live where the attacker's velocity touches down — the identity-federation boundary, in machine time.

SPR{K3 is a security research operation that pairs offensive vulnerability research with runtime behavioral defense. Defend is our runtime agent. To talk about a deployment, reach us at support@sprk3.com.