Agentic Offensive Techniques

“Offensive agentic techniques” is the phrase Chainalysis used on 30 October 2026 to attribute an intrusion into its systems and internal tools — the incident notice that introduced the term to incident-response vocabulary (BleepingComputer’s coverage ran an explainer section asking what the phrase even means).^{1 2} The phrase covers attack workflows run by LLM-driven multi-agent systems with little human involvement: reconnaissance, vulnerability discovery, exploitation, and post-exploitation chained by agents that accumulate findings as they work and pick the next step themselves. Two October 2026 events define the record so far: Microsoft Threat Intelligence’s 21 October report on the Storm-0940 campaign, and the Chainalysis disclosure ten days later.

ARTEX

ARTEX is an open-source penetration-testing framework and the first such tool documented in operational use by a threat group. It is a multi-agent LLM system written in Go with a Next.js frontend that can drive any AI model; the UI and generated output default to English and switch to Korean, Mandarin, Spanish, or Japanese. Its agents run an autonomous penetration test from reconnaissance through data exfiltration with little human interaction, accumulating discovered assets and vulnerabilities into a graph as they go. Microsoft reports threat actors across multiple geographic regions using the framework, and public reporting in October 2026 tied it to personal-data breaches at Korean financial institutions.³

Storm-0940 and the ConnectWise compromise

Storm-0940 — China-state aligned, active since 2021, data-theft focused — used ARTEX from September 2026 against hundreds of organizations across industries including aerospace and defense, automotive, financial services, government, semiconductors, software, and think tanks.⁴ Inside the ConnectWise multi-tenant compromise, stolen cloud-application identities let the agents attempt sign-ins to more than 2,250 Microsoft 365 tenants at 2,900 attempts per minute, authenticating as already-trusted applications with no interactive user sign-in; more than 200 sign-ins landed in under four minutes through four application credentials. A parallel password-spray campaign (10–14 October, infrastructure 144.172.64[.]99) hit 327 accounts across eight organizations with more than 151,000 failed logons, peaking at 2,900 failures per minute on 11 October, and produced zero successful authentications — nearly 98% of the traffic was lockout responses. Several ARTEX-driven attacks reached privileged cloud access in under three hours from initial targeting.⁵

In the affected tenants the agents went past authentication into Microsoft Graph and directory operations: reconnaissance, application-credential changes, and identity, group, and privileged-role modifications — including one application assigning itself Global Administrator. The credential changes drive Microsoft’s remediation order: they can leave access in place through other identities and cloud services after the original compromised application is disabled, so responders should preserve configuration and evidence before deleting enterprise applications, search tenants by application ID rather than display name, and review activity back to 1 October. Microsoft’s caveat holds throughout: an affected application, or even a successful authentication, does not by itself establish that data was accessed or exfiltrated.⁶

The Chainalysis disclosure

Chainalysis published its incident notice and the full customer email on 30 October 2026: an external actor used “offensive agentic techniques” to reach systems and internal tools earlier that month. The accessed data was limited to non-sensitive customer account information — user IDs, full names, email addresses, organization role labels — with no indication of access to investigation content (graphs, notes, cases), transaction or query results, plaintext passwords, MFA secrets, or session tokens. The company said the incident is unrelated to the Binance theft, has engaged third-party experts, and is “using sophisticated large language models to support a broader review” of its platform’s security; customers were told to enable two-factor authentication and watch for password-reset and authentication-prompt scams.⁷

What the notice leaves open is most of the technical picture: which vulnerabilities were exploited, which internal tools were reached, how long the actor had access, and whether the operation ran on an existing agentic framework — ARTEX is the one named in reporting — or on custom-built agents.⁸

What agent automation changes

Microsoft’s framing of the difference: agents are not constrained by human working hours, can attempt multiple breach paths simultaneously, and so compress the interval from target selection to objective. The observed traffic pattern is a high volume of alerts arriving at a pace that leaves responders little time to remediate in a coordinated way. The spray campaign’s 151,000 failed logons were almost entirely noise; the small number of successful application-authentications carried the actual intrusion. Microsoft’s summary of the ConnectWise campaign: most of the targeting was not successful, and the actor nonetheless achieved privileged cloud persistence at many organizations in a brief time.⁹

The attacker-hordes question

These events landed in the middle of an open argument. Joshua Saxe’s 22 October 2026 essay on AI-era damages asked where the “agentic attacker hordes” are — global losses to fraud and hacking have not visibly moved with AI capability — one day after Microsoft published the Storm-0940 record. Both observations stand as data: agent automation is demonstrably operational in intrusions (so far concentrated in a state-aligned actor’s broad-target campaigns, plus at least one corporate attribution), while aggregate damages remain unmoved. Saxe’s binding constraints describe criminal business models — workforce limits, workflow maturation, law-enforcement scaling — and the October record is mostly state-aligned operations and one security vendor’s intrusion. The damages record and the constraint arguments live in cyber-losses-vs-ai-capabilities.

Related

• cyber-losses-vs-ai-capabilities — the damages-versus-capability record; its attacker-side constraints are what the October events test
• aisi-unsanctioned-agent-behaviour-2026 — the agent-behavior twin: an eval agent socially engineering a real maintainer on the open internet
• anthropic-cybersecurity-eval-incidents — models doing offensive work in evals and internal use — the evaluation-side evidence base
• mitre-attack-emulation-plans — human-run adversary emulation plans; ARTEX automates the same reconnaissance-to-impact tradecraft chain
• specification-gaming-openai-hf-incident — agents executing a multi-step intrusion chain toward an objective (there: the grader; here: the task list)

Sources

• 2026 — Chainalysis Security Incident Information
• Microsoft Threat Intelligence 2026 — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
• Ax Sharma 2026 — Chainalysis discloses data breach from “offensive agentic techniques”

Footnotes

1. 2026 — Chainalysis Security Incident Information ↩

2. Ax Sharma 2026 — Chainalysis discloses data breach from “offensive agentic techniques” ↩

3. Microsoft Threat Intelligence 2026 — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise ↩

4. Microsoft Threat Intelligence 2026 — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise ↩

5. Microsoft Threat Intelligence 2026 — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise ↩

6. Microsoft Threat Intelligence 2026 — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise ↩

7. 2026 — Chainalysis Security Incident Information ↩

8. Ax Sharma 2026 — Chainalysis discloses data breach from “offensive agentic techniques” ↩

9. Microsoft Threat Intelligence 2026 — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise ↩