VULNpocalypse
HighSupply chainOngoing

ARTEX agentic AI used in ConnectWise supply chain attack and VAPOR PANDA espionage campaign

China-aligned actors used the ARTEX agentic AI framework against ConnectWise customers and 200+ organizations, so review Microsoft 365 app access now.

Published
Updated
Exploitation
Yes, Microsoft observed follow-on activity in multiple customer environments and CrowdStrike reports about 70% of VAPOR PANDA targets confirmed or likely compromised

What happened

ConnectWise supply chain compromise (Storm-0940). Microsoft says that as early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX to automate attacks against hundreds of organizations. Microsoft assesses Storm-0940 was responsible for the ConnectWise supply chain compromise of a multi-tenant application (Microsoft Security Blog).

  • ConnectWise first identified suspicious activity on October 15. On October 17 it found unauthorized access to application identities in its Cloud Backup environment (Infosecurity Magazine).
  • ConnectWise took Cloud Backup (previously SkyKick), SaaS Security and Cloud Management offline. On October 22 it began a phased restoration of Cloud Backup and told customers to keep affected connections disabled until formal instructions apply to their service (Infosecurity Magazine).
  • ConnectWise says existing backup archives remain encrypted, isolated and preserved with no indication of compromise, and that there is no evidence other ConnectWise products are affected (Infosecurity Magazine).
  • Between October 10 and 14, infrastructure at 144.172.64[.]99 ran a password-spray campaign against 327 accounts at eight organizations, with more than 151,000 failed logons. Microsoft observed no successful authentication from that campaign (Microsoft Security Blog).
  • One IP in ConnectWise’s later indicators matched that same address (Microsoft Security Blog).
  • After taking control of ConnectWise cloud application identities, the actor used ARTEX to attempt sign-ins to more than 2,250 tenants, reaching 2,900 attempts per minute. It abused permissions customers had already granted, so no interactive user sign-in was needed (Microsoft Security Blog, The Register).
  • In multiple environments Microsoft saw follow-on activity through Microsoft Graph. This included reconnaissance, application credential modifications, and changes involving identities, groups and privileged roles. Some instances went from initial targeting to privileged cloud access in under 3 hours (Microsoft Security Blog).
  • Microsoft says the credential changes can remain active as a backdoor even after the original compromised application is remediated. It also says the activity did not result from a vulnerability in Microsoft products (Microsoft Security Blog).
  • Microsoft has not disclosed how many customers were compromised or whether data was stolen. A successful login does not necessarily mean data was accessed (The Register).

A separate campaign (VAPOR PANDA). CrowdStrike reports that starting October 17, 2026, VAPOR PANDA used ARTEX with the DeepSeek LLM and a second commercial LLM against more than 200 organizations in at least 14 countries (CrowdStrike). CrowdStrike says this is separate from the Storm-0940 activity.

  • Targets included foreign ministries, 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in the U.S., Belgium and the Philippines (CrowdStrike).
  • CrowdStrike confirmed post-exploitation activity at nine organizations, including deployment of the BLOODALCHEMY backdoor. Recovered transcripts showed a human operator steering the agents and directing them to inventory endpoint sensor coverage (CrowdStrike).
  • CrowdStrike told CyberScoop that about 70% of targets were confirmed compromised or had moderate confidence evidence of intrusion, and that the campaign remains active (CyberScoop).

Other ARTEX use. WorkOS reported unauthorized access on October 30, 2026 to an internal sales application, exposing business contacts and summaries of customer communications. Its founder said the attacker used ARTEX, based on user agents such as artex-enrich/1.0 and norma/0.4. WorkOS says no app data or production services were accessed (BleepingComputer). Who was behind the WorkOS attack is not confirmed.

About ARTEX. ARTEX is an open-source multi-agent LLM framework written in Go with a Next.js frontend. It can use any AI model to run a penetration test from reconnaissance through data exfiltration (Microsoft Security Blog). BleepingComputer reports the project later went private but forks remain available (BleepingComputer).

Am I affected?

  • ConnectWise customers. You are in scope if your Microsoft 365 tenant granted access to ConnectWise cloud applications, such as Cloud Backup (previously SkyKick), SaaS Security or Cloud Management. The full list of affected customers is not confirmed.
  • Targeted sectors. Microsoft lists aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks and non-profits. CrowdStrike names foreign ministries, telecoms, pharmaceutical, nuclear and financial organizations.
  • Password spray exposure. Any Microsoft 365 or Exchange Online tenant could see spray activity. Microsoft saw lockout responses account for nearly 98% of the spray activity it recorded.
  • WorkOS customers. WorkOS says it will notify affected customers directly and warned users to watch for phishing or social engineering that uses the exposed information (BleepingComputer).
  • No CVE or patch. No CVE or software fix is named in the sources. Microsoft says this was not a vulnerability in its products.

What to do now

  1. Keep ConnectWise connections disabled until ConnectWise gives formal reconnection instructions for your service, and follow its published containment guidance (Infosecurity Magazine).
  2. Review service principal sign-ins in Microsoft Entra, alongside subsequent Microsoft Graph activity, directory changes and resource access. Correlate suspicious events with authorized administrative activity (Microsoft Security Blog).
  3. Look for unexpected application credential additions and privilege, group or role changes. Remediating the original application may not remove these backdoors (Microsoft Security Blog).
  4. Search authentication logs for the 144.172.64.x range, including 144.172.64[.]99, and for heavy failed-logon or lockout bursts against Microsoft 365 and Exchange Online.
  5. Use the Microsoft Defender XDR detections and hunting queries for suspicious Microsoft Graph activity and known threat infrastructure.
  6. Preserve relevant logs and evidence before making changes.
  7. Check that endpoint sensors are deployed on all hosts. CrowdStrike reports VAPOR PANDA’s workflow included identifying hosts without a sensor (CrowdStrike).
  8. If you use WorkOS, treat unexpected emails that reference your account or sales conversations with caution until WorkOS contacts you.
  9. Plan for machine-speed attacks. Microsoft notes that AI-driven activity leaves defenders very little time to respond, so prepare coordinated response steps in advance.

Sources