China-Linked AI Hackers Breach 2,250 Cloud Tenants
Microsoft says the China-linked group Storm-0940 used the AI tool ARTEX to breach 2,250 Microsoft 365 cloud tenants via a ConnectWise supply chain attack.
Microsoft has blamed a China-linked hacking group for one of the fastest AI-powered cyberattacks ever recorded. In a report published on October 21, the company's Threat Intelligence team said the group, tracked as Storm-0940, used an AI-driven penetration testing framework called ARTEX to break into the cloud accounts of hundreds of organisations around the world. Some victims were taken from initial targeting to full privileged access in less than three hours.
The attack on ConnectWise
The attackers took advantage of a supply chain compromise at ConnectWise, an IT management software vendor. ConnectWise disclosed on October 16 that someone had gained unauthorised access to identities used by its cloud applications, forcing it to pull its Cloud Backup, SaaS Security and Cloud Management services offline. Microsoft now says Storm-0940 was behind that breach. The group grabbed the identities of multiple ConnectWise cloud applications, including a compromised API secret, and used them to sign in to customer environments. Because these apps already had access permissions, the attackers did not need any interactive user login - the AI agents simply walked through the trusted door.
2,900 attempts a minute
The scale and speed were extreme. Microsoft says Storm-0940 attempted to sign in to more than 2,250 linked tenants, firing off authentication attempts at a peak rate of 2,900 per minute - a pace that gives defenders almost no time to detect and respond. The report also details an earlier automated campaign between October 10 and 14, in which infrastructure at a single IP address targeted 327 accounts across eight organisations. Microsoft captured more than 151,000 failed login events during that window, with more than 111,000 failures on October 11 alone. No successful logins came from that password-spraying wave - but the attackers then switched to the compromised ConnectWise identities, and that is when the breaches began.
AI did the heavy lifting
ARTEX is the alarming part of the story. The framework, written in Go, uses AI agents to automate every stage of an intrusion: reconnaissance, vulnerability discovery, credential attacks, privilege changes and data theft. It was released for legitimate security testing in July 2026 and taken closed-source this month after reported misuse - including data breaches at South Korean financial institutions. Microsoft says the AI-accelerated follow-on activity included reconnaissance, changes to application credentials and attempts to modify privileges for persistent access. In one environment, an application assigned itself the Global Administrator role, handing the attackers the highest possible control over a Microsoft cloud environment.
Who is Storm-0940
Storm-0940 is no newcomer. Microsoft says the China state-aligned espionage group has been active since at least 2021, previously relying on password spraying and attacks on internet-facing apps. Its targets now span aerospace and defense, finance, government, manufacturing, technology, think tanks and non-profits. Microsoft stressed that the campaign did not come from any compromise of, or vulnerability in, Microsoft's own corporate systems, products or services. The weakness was in the trust chain between vendors: one compromised app identity can open thousands of customer tenants.
What defenders should do
Microsoft advises security teams to audit third-party OAuth permissions, investigate unexpected sign-ins by non-human service principals and watch for sudden bursts of authentication attempts. The core message: AI has cut the time between targeting and takeover to hours, and defence plans need to assume that speed.
Sources
- Microsoft - https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/ - The Hacker News - https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html - The Register - https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687