# Microsoft says China-aligned Storm-0940 used open-source AI agent ARTEX in cloud attacks

> Original title: Microsoft published a new report saying that it has seen cyberattacks carried out by a Chinese state-aligned actor called Storm-0940, whi...

- Source: Rohan Paul
- Published: 2026-10-22T03:41:27.000Z
- Bad Influence: https://badinfluence.news/items/xljfi7j2t8x7f03gllzxtxvp5
- Original: https://x.com/rohanpaul_ai/status/2113113477552169349

## Summary

Microsoft reports that China state-aligned actor Storm-0940 used the AI agent framework ARTEX to automate attacks on hundreds of organizations. In some intrusions, the attackers reached privileged cloud access in under 3 hours by abusing OAuth app keys, skipping user logins and MFA. Most targeting failed, including a password spray with over 151K failures and no successes.

## Why it matters

The post summarizes Microsoft's report on a state-aligned actor using an open-source AI agent framework, showing how fast it moved from targeting to privileged cloud access.

## Post

Microsoft published a new report saying that it has seen cyberattacks carried out by a Chinese state-aligned actor called Storm-0940, which used a Chinese AI agent named Artex to automate attacks aimed at hundreds of organizations worldwide in a broad range of industries.

ARTEX, released on GitHub as open source, chains LLM agents through a penetration test from reconnaissance to data theft with little human input.

The keys belonged to ConnectWise’s Microsoft 365 backup and management apps, already trusted with wide access, so signing in skipped user logins and MFA.

Several ARTEX-driven intrusions went from first targeting to privileged cloud access in under 3 hours.

Inside some tenants, the agents queried Microsoft Graph, added credentials to other apps and had a ConnectWise app grant itself Global Administrator.

Most targeting still failed, including a password spray that logged 151K+ failures without one success, and an app sign-in alone does not prove theft.

OAuth app abuse is old Storm-0940 tradecraft, but ARTEX ran it fast enough to leave defenders little time between alert and revocation.

![](https://badinfluence.news/api/img-proxy?u=https%3A%2F%2Fpbs.twimg.com%2Fmedia%2FHVNIgtxacAATXmk.jpg&mode=thumb&exp=1793404800&sig=5ab8880315c443b3)