Microsoft says Chinese hacking group attacked over 100 organisations using agentic AI, here is how
Follow UsMicrosoft claims China-linked hacking group Storm-0940 used the ARTEX AI framework to target more than 100 organisations worldwide.
The campaign reportedly involved supply-chain attacks, OAuth abuse and password spraying, with some attempts gaining access in under three hours.
Microsoft recommends disabling affected ConnectWise connections, reviewing Microsoft 365 and Entra audit logs, and checking for unauthorised configuration changes.
Windows maker Microsoft, in a recent blog post, claimed a Chinese-based hacker group, ‘Storm-0940’, used artificial intelligence to target over 100 companies across the world. ARTEX, an AI testing framework, was deployed to carry out these attacks and gain access to the cloud database of the affected organisations. The turnaround time to gain access in a few cases was under three hours. Microsoft said the actor used supply chain attacks to target ConnectWise, an IT services company specialising in Cloud services for these companies.
SurveyAccording to Microsoft, ARTEX compromised the user sign-in page that is used to authenticate Microsoft 365 customers. The changes could include modifying app credentials, escalating privileges, unusual sign-ins and more. For the unaware, the China-state aligned actor has been active since 2021 and targets data theft from companies. The affected industries from this attack include aerospace, defence, chemicals, energy, government, legal, media, semiconductor, technology and more.
In the case of ConnectWise, ARTEX was used to boost scanning, OAuth abuse and password spraying. “Storm-0940’s activity illustrates how a threat actor with a broad target set can use an agentic AI tool and privileged authentication material to quickly attempt to compromise many organisations,” Microsoft said. However, in the majority of cases, the targeting was not successful.
ConnectWise issued an advisory in this regard earlier on October 16, 2026. ARTEX made 2,900 sign-in attempts/minute and affected 327 accounts across eight organisations. Microsoft recommended a host of mitigation measures to reduce the impact.
ARTEX threat: What Microsoft recommends
Microsoft recommends that organisations disable ConnectWise connections until the issue is fixed. Before deleting enterprise apps, users should preserve configuration to track any changes. Plus, reviewing the Microsoft 365 tenant where the affected applications were authorised is recommended. Microsoft also recommends reviewing Microsoft 365 and Entra audit records for any changes.
Also Read: PHP security alert: Why CERT-In, FBI, Google and OpenAI are warning users and how to fix it
The use of AI in such sophisticated attacks marks one of the evolving downsides of evolving technology. Activities include gaining administrative access, changing key configurations such as account information and passwords and stealing data.
