AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise | Microsoft Security Blog

Microsoft said in a Security Blog post that Storm-0940, an actor it described as China-state aligned, used the open-source agentic AI penetration testing framework ARTEX to automate attacks against hundreds of organisations globally across a broad range of industries. The post is dated October 21, 2026. Microsoft said the targeting began as early as September 2026.

According to Microsoft, several of the attacks resulted in the actor obtaining privileged access to an organisation's cloud infrastructure. Microsoft said that in multiple instances the time from initial targeting to privileged access was less than three hours. The post described the campaign as automated and large-scale, and described ARTEX as an open-source framework for agentic AI penetration testing.

Microsoft attributed the campaign to Storm-0940, the designation it uses for the actor in the post, and described the actor as China-state aligned. Microsoft said the attacks targeted hundreds of organisations across a broad range of industries globally. The post states that several of the attacks resulted in privileged access to cloud infrastructure, and that in multiple instances the interval from initial targeting to that access was under three hours. It presents the framework used, ARTEX, as open source and as an agentic AI penetration testing framework, and places the start of the activity as early as September 2026. Microsoft published the account on its Security Blog on October 21, 2026.