Tools AI Risk Radar ai-incident-0255
Incident record
Microsoft links ARTEX-assisted attacks to Storm-0940
- Severity
- High
- Status
- In the wild
- Type
- Agent Misuse
- Target
- Enterprise systems and ConnectWise
- Actor
- Storm-0940, according to Microsoft
What happened
Microsoft reports AI-assisted targeting of hundreds of organisations since September. It assesses Storm-0940 to be responsible for the ConnectWise compromise and observed some transitions to privileged access within three hours.
Microsoft’s 21 October report distinguishes suspicious authentication from confirmed data access or exfiltration. Zscaler separately analysed an ARTEX deployment and its operational records. The use of the same tool alone does not establish that every reported operator is the same actor.
Sources
- Microsoft threat investigation, 21 October 2026www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-…
- Zscaler primary investigationwww.zscaler.com/it/blogs/security-research/inside-global-ai-…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026