ARTEX agentic-AI intrusion campaign: state-aligned actor used a multi-agent LLM pentest framework to automate a ConnectWise Cloud Backup supply-chain compromise

Aviatrix's Week 43 (published 2026-10-24) threat report documents a suspected Chinese state-aligned actor deploying ARTEX, a Go-based multi-agent LLM penetration-testing framework, to automate a supply-chain compromise of ConnectWise Cloud Backup between Oct 10–14, 2026. The framework generated over 151,000 failed logon events (peaking at ~2,900/min), obtained valid OAuth credentials for ConnectWise cloud identities, and used the pre-granted permissions to reach downstream Microsoft 365 customer tenants, escalating privileges and establishing persistence across more than 2,250 tenants — all machine-speed and without a human operator.

This is the clearest public evidence that agentic AI has moved from theoretical offensive capability to an operationalized weapon: a multi-agent LLM framework compressed an enterprise identity-compromise kill chain from weeks to under three hours per target with zero human intervention. For defenders it means the adversary may now be an autonomous multi-agent system driving account takeover, lateral movement, and persistence, so detection must target the machine-speed volumetric/behavioral signature rather than a human attacker's pattern.

Attacker-side agentic AI. A state-aligned actor used a multi-agent LLM framework to automate OAuth credential acquisition (machine-speed password spraying, peaking ~2,900 failures/minute), then used the acquired OAuth credentials to authenticate to downstream M365 customer tenants without interactive login, perform directory reconnaissance, escalate privileges by modifying IAM roles and OAuth app credentials, move laterally across thousands of tenants, and plant persistent backdoors via unauthorized OAuth credential additions.

ConnectWise Cloud Backup and downstream Microsoft 365 tenants; attacker tooling = ARTEX, a Go-based multi-agent LLM penetration-testing framework

Defender-side controls: enforce MFA/step-up auth and conditional access, monitor for anomalous OAuth application credential additions and IAM role modifications, review pre-granted OAuth permissions and cross-tenant access, instrument identity platform logs for machine-speed password-spray signature, and segment cloud identity from MSP/service-provider trust chains. No product patch for ARTEX (attacker tooling); mitigation is detection and least-privilege for service-provider OAuth grants.