Microsoft: Storm-0940 used AI framework Artex in automated attacks on hundreds of organizations

The notable shift here is tempo: an AI framework compressing the path from initial access to privileged cloud control into hours collapses the window defenders rely on for detection and response. Storm-0940's link to the ConnectWise multi-tenant supply-chain incident matters because it ties automated, high-velocity intrusion to a vector that reaches many downstream customers through a single trusted provider. The affected population is less the targeted organizations than the managed-service ecosystem layered on top of them. Whether Artex-style automation becomes a repeatable template for other groups, and whether cloud identity controls adapt to sub-three-hour escalation, is the open question.