ARTEX agentic-AI intrusion campaigns: Storm-0940 (Microsoft) and VAPOR PANDA (CrowdStrike)

What happened

• Microsoft (21 Oct): China state-aligned Storm-0940 used ARTEX, an open-source multi-agent pentest framework, and Microsoft “assesses” it was responsible for the ConnectWise Cloud Backup supply-chain compromise. Storm-0940 used the stolen ConnectWise app identities to sign in to more than 2,250 tenants; a separate 10 to 14 Oct password spray hit 327 accounts at eight organizations (151,000+ failed logons, no successes observed). Time from targeting to privileged access was under three hours in several cases.
• CrowdStrike (29 Oct): VAPOR PANDA used ARTEX from 17 Oct 2026 against more than 200 organizations in at least 14 countries over 11 days, with confirmed post-exploitation at nine (BLOODALCHEMY backdoor) and spraying at 12 more. Targets included foreign ministries, a Middle East interior ministry, US pharma, semiconductor, defense, nuclear and finance firms, and telecoms. Primary model was DeepSeek, plus an unconfirmed commercial LLM. THN reports techniques such as unsigned SAML plus XXE to reach the cloud metadata service, and token forging with keys unrotated since 2022.
• Attribution: Microsoft names Storm-0940 (China state-aligned). CrowdStrike names VAPOR PANDA; THN reports CrowdStrike’s overlap with Trend Micro’s Earth Estries. Neither source checked equates the two names.
• Response: Microsoft says keep ConnectWise app connections disabled until ConnectWise gives restoration steps and hunt by application ID. See catalogue entry “ConnectWise Cloud Backup app identities abused” for the tenant counts reported by Huntress and THN (162 / 173), which differ from Microsoft’s 2,250 sign-in figure.

Sources

• https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
• https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
• https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.