Google Says ARTEX and Other AI Attack Frameworks Are Now Running Real Intrusions, After Microsoft Tied ARTEX to the ConnectWise Hack

Updated November 2, 2026: Google's threat intelligence team has published its own account of ARTEX and similar AI agent frameworks being used in real attacks. The new section directly below covers it; the original October 24 report follows unchanged.

November 2: Google says AI attack frameworks have crossed into real intrusions#

Google's account widens the story from one campaign to a pattern: several groups are now letting AI agents run large parts of a break-in. In a report dated October 30, Google Threat Intelligence Group (GTIG) said it and Mandiant have seen threat actors use open-source multi-agent pentesting frameworks, including ARTEX, PentAGI and CAIRN, in incident response cases since late August 2026. It says agents carried out significant parts of attacks, such as lateral movement, database exploitation and preparing data for theft.

GTIG says ARTEX's original developer took the GitHub repository down in October 2026 because of widespread abuse, but the framework keeps spreading through community forks, including one called ScopeWeaver and a commercial version called ARTEX PRO. That resolves a question we left open in the original report about its status. GTIG says users of ARTEX include both financially motivated extortion groups and suspected espionage operators.

GTIG says a campaign it tracks as UNC7228, which Wiz Research has been following, overlaps with the activity Microsoft tracks as Storm-0940. It says Wiz now dates the campaign to at least August 2026 and found targeting, compromise and data theft at organizations in the US and Europe in enterprise software, industrial automation, semiconductors and telecoms. According to GTIG, the actor typically went from its first compromised account to deep system access in about four hours, and in one case in 15 minutes.

GTIG describes the agents as fast but messy. It says individual ARTEX bursts lasted roughly 2 to 25 seconds, and that one attempt to run commands produced 240 log events, with sub-agents apparently overwriting each other. It says frameworks like ARTEX "currently trade stealth for velocity," which gives defenders more to detect. GTIG places attackers at stage five of a seven-stage path toward fully autonomous attacks. It expects largely unsupervised but unsophisticated attacks within one to three months.

Mandiant's advice is that these tools do not change attackers' techniques but cut the time needed to chain them. It recommends five layers of defence: protecting control planes, replacing long-lived secrets with short-lived credentials, reducing attack paths, guarding high-impact business functions, and watching for unusual bursts of activity. Other recent reports describe related activity, including CrowdStrike's account of a second China-nexus group using ARTEX and Reuters' report on an operator who used Cairn.

Limits of the November 2 update#

• GTIG's report is dated October 30, before this edition's window. We are adding it now because we had not covered it; it was relayed again by security outlets on November 2.
• The UNC7228 to Storm-0940 link is described as an overlap, not a confirmed match, and the four-hour figure comes from Wiz's research as summarized by GTIG.
• GTIG does not say how many organizations were hit across the cases it describes.
• We have left out the technique detail and indicators GTIG published.

Microsoft's account of the ConnectWise breach is a detailed public case of a state-aligned group running an AI agent framework in a real intrusion, and its main lesson is about speed: Microsoft says the activity generated alerts but left defenders very little time to act on them. In a security blog post published on Wednesday, October 21, Microsoft Threat Intelligence said Storm-0940, which it describes as a China-state aligned actor, used the agentic penetration-testing framework ARTEX to automate attacks "targeting hundreds of organizations globally across a broad range of industries."

What Microsoft says happened#

Microsoft says that as early as September 2026, Storm-0940 used ARTEX for scanning and reconnaissance, password spraying and abuse of OAuth applications. It lists targeted sectors including aerospace and defense, energy, financial services, government, semiconductors, software and think tanks.

Microsoft assesses that Storm-0940 was responsible for the compromise of ConnectWise's Cloud Backup service, which ConnectWise disclosed on October 16. After the unauthorized access, Microsoft says, "Storm-0940 used ARTEX to attempt to sign-in to more than 2,250 tenants." It says the attacker's AI agents then used the stolen app credentials to reach some customer environments.

In some environments, Microsoft says, the agents went on to make changes involving identities, groups and privileged roles. It says several of the group's attacks reached privileged cloud access, "including multiple instances where the time from initial targeting to privileged access was less than 3 hours."

The earlier password spray#

Microsoft describes a separate, earlier campaign from October 10 to 14 that targeted 327 accounts across eight organizations. It says its telemetry recorded more than 151,000 failed logons, peaking on October 11 at 2,900 failures per minute. "Despite the scale, no successful authentication, token issuance, Graph call, or directory change was observed," Microsoft wrote. It links that campaign to the ConnectWise attack through shared infrastructure.

What Microsoft says about its own systems and customers#

Microsoft says the activity "did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services." It also says the presence of an affected application, or even a successful sign-in, "does not necessarily indicate that customer data was accessed or exfiltrated." Its advice to customers includes keeping affected ConnectWise app connections disabled until ConnectWise gives restoration instructions, and not deleting enterprise applications as a first step, so evidence is preserved.

CyberScoop reported that ConnectWise temporarily shut down services on Saturday after the attacks, began restoring them in phases on Wednesday, and expects recovery to take several days. It also quoted Microsoft executive vice president Igor Tsyganskiy: "Since early October, a wave of AI-driven cyberattacks has been ongoing."

What ARTEX is#

Microsoft describes ARTEX as "an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows," built as a multi-agent system that runs "from reconnaissance through data exfiltration with little needed human interaction." It says threat actors in several regions are using it. We covered ARTEX's earlier use against Korean financial institutions.

Limits#

• This story is from October 21, outside our usual daily window; we are publishing it now because we had not covered it.
• The attribution is Microsoft's assessment. We have not seen a statement from ConnectWise naming Storm-0940, and Microsoft has not said how many customers were compromised.
• CyberScoop's article quotes Microsoft as saying Storm-0940 reached "more than 2,250 tenants at 2,900 sign-in attempts per minute." In Microsoft's blog, the 2,900-per-minute figure belongs to the earlier failed-logon password spray, not to the tenant sign-in attempts, so we keep the two numbers separate.
• Microsoft calls ARTEX open source. Our earlier coverage cited an AFP report that ARTEX's developer had taken it closed-source; we did not check its current status.
• We have left out the network indicators Microsoft published.

Sources#

• Google Threat Intelligence Group: ARTEX and Friends, Enter Agentic Offensive Frameworks (October 30, 2026)
• Cyber Security News: Hackers Use ARTEX AI Agents to Automate Active Directory Attacks (November 2, 2026)
• Microsoft Security Blog: AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (October 21, 2026)
• CyberScoop: Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group (October 21, 2026)
• Times of AI: CrowdStrike says the Korean bank attacker drove ARTEX through Claude Code (October 2026)