Microsoft says China-government-linked Storm-0940 used AI agent ARTEX to attack hundreds of organizations worldwide

Microsoft published the findings of its investigation into the hacker group Storm-0940, saying that since September 2026 it has used the AI agent ARTEX to attack hundreds of organizations worldwide, including automakers, financial institutions, government agencies and semiconductor manufacturers. ARTEX is an AI-driven framework that can autonomously carry out penetration-testing tasks from target information gathering to data theft. Microsoft said the group attempted logins against more than 2,250 targets at a rate of 2,900 login attempts per minute, that some attacks achieved privileged access within three hours of the target being identified, and that ARTEX was observed being used to attack ConnectWise's IT management system. Microsoft advised administrators to check for activity since October 15, 2026, with records going back to October 1 where available, and to review Microsoft 365 audit records.