Microsoft: China-state crew Storm-0940 ran ARTEX at 2,900 sign-in attempts a minute

Microsoft disclosed that China-state-aligned actor Storm-0940 was behind the ConnectWise Cloud Backup supply-chain compromise — and that it used ARTEX, the same agentic pentesting framework behind the Japan breach wave, to automate scanning, password spraying and OAuth abuse at ‘machine speed’ across hundreds of organizations worldwide.

In the ConnectWise incident alone, Storm-0940's agents attempted sign-ins to more than 2,250 tenants, peaking at 2,900 attempts per minute; Microsoft says several victims went from first targeting to privileged cloud access in under three hours. Zscaler found the deployment wired to DeepSeek, GLM and Grok, with prompts showing the models dividing tasks and reviewing each other's work.