This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A Chinese state-aligned threat actor used the agentic AI framework ARTEX to automate and accelerate cyberattacks against hundreds of organizations globally, compromising cloud infrastructure at machine speed.
Microsoft reported that China-aligned hackers used ARTEX, an AI penetration-testing framework, to access customers' Microsoft 365 environments through stolen credentials for ConnectWise's cloud backup services. Agents reportedly changed credentials and privileges in some environments to retain unauthorized access. The activity formed part of a global campaign; the extent of compromise and any data theft remained uncertain.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
The incident involved state-aligned threat actors using an autonomous AI penetration testing framework to conduct rapid, large-scale cyberattacks against critical infrastructure and organizations.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was initiated by human threat actors (Storm-0940) who intentionally deployed the ARTEX AI framework to conduct malicious cyberattacks.
A China-aligned threat actor used the autonomous multi-agent AI framework ARTEX to conduct rapid cyberattacks against critical sectors globally. By executing reconnaissance and establishing backdoors in less than 3 hours, the incident highlights how agentic AI accelerates cyber threats to machine speed, posing substantial risks to critical infrastructure, defense intelligence, and economic security.
The report explicitly describes ARTEX as 'a multi-agent LLM system' and 'a system of LLM-driven agents that run an autonomous penetration test from reconnaissance through data exfiltration with little needed human interaction.'
High Risk: The AI system was used to automate attacks targeting critical infrastructure sectors, including energy, financial services, and defense, which has significant implications for public safety and security.
The AI system (ARTEX) was designed to automate offensive security workflows, specifically scanning, reconnaissance, and identifying vulnerable targets and assets to execute exploits.
The reports from Microsoft and Reuters provide highly detailed, technical, and consistent accounts of the incident, including specific timelines, tactics, techniques, and indicators of compromise. The role of the AI system (ARTEX) is explicitly defined as an agentic framework used to automate the attacks.
None. The incident is clearly a state-aligned cyber campaign leveraging an AI-driven automation framework.
Technology
Autonomous LLM Penetration Testing
ARTEX automates full attack chains from recon to exfiltration at machine speed.
AI-Accelerated Multi-Agent Workflows
Multi-agent systems execute concurrent attack paths, reducing breach times.
Lack of AI Abuse Guardrails
Open-source ARTEX framework allows any LLM to be used for offensive tasks.
Data Inputs
Stolen OAuth App Credentials
AI agents used compromised credentials to bypass interactive user sign-ins.
High-Volume Telemetry Noise
AI-driven automated actions generate massive logs that mask malicious intent.
Abused Multi-Tenant Access Tokens
AI leveraged existing trusted app tokens to query Microsoft Graph APIs.
Human Factors
Defender Cognitive Overload
Rapid machine-speed attacks leave defenders insufficient time to respond.
Minimal Human Intervention Needed
AI agents operate autonomously without requiring active human operators.
Over-Reliance on Trusted Apps
Users trusted ConnectWise backup app, overlooking anomalous API activities.
Process and Methods
Inadequate Real-Time AI Detection
Traditional security monitoring processes failed to block rapid AI attacks.
Slow Incident Response Processes
Human-in-the-loop response processes cannot match machine-speed exploits.
Excessive App Permissions Granted
Multi-tenant apps were granted overly broad privileges, easing AI movement.
Management
Inadequate AI Risk Assessments
Organizations failed to assess risks of AI-driven supply chain attacks.
Poor Privilege Governance
Management failed to enforce least-privilege policies for third-party apps.
Lack of AI Posture Monitoring
No centralized oversight of AI assets and agentic risks in the enterprise.
Regulatory Environment
Unregulated Dual-Use AI Software
Lack of legal controls on open-source autonomous offensive AI systems.
Absence of Agentic AI Standards
No regulatory oversight on safety guardrails for agentic LLM deployments.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
