Microsoft: China-linked hackers used ARTEX AI to attack ConnectWise
Start here
According to a report published by Microsoft on October 21, the China-linked group Storm-0940 has since September used the open-source AI penetration testing framework ARTEX to launch automated attacks against hundreds of organizations worldwide, automating reconnaissance, password spraying and data theft; some attacks obtained privileged access to cloud environments in under 3 hours, with targets spanning government, defense, energy, finance, semiconductors and other sectors, and most attacks were unsuccessful. From October 10 to 14, it launched more than 151,000 failed logins against 327 accounts at 8 institutions, peaking at 2,900 per minute; on October 15, after obtaining ConnectWise cloud application credentials, it attempted logins as an authorized user against approximately 2,250 Microsoft 365 tenants, and entered some customer environments to access files such as email. ConnectWise disclosed on October 17 that the Cloud Backup application identity had been accessed without authorization, disabled 7 application identities and revoked certificates, suspended Cloud Backup, SaaS Security and Cloud Management before restoring them in phases, and stated that according to Microsoft threat intelligence, the attacks appeared to come from a group aligned with the Chinese government.
Generated by AI from reports · Updated 2 days ago
Latest developments
Progress timeline
- WebAI Threat Watch (aithreat.io)· Media coverageChinese AI model carries out complex cyberattacks in controlled tests, researchers say(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageMicrosoft: Storm-0940 через ConnectWise с ИИ взломала 2250 аккаунтов(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageHackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageHackers Abuse ConnectWise Cloud Backup Credentials to Launch AI-Driven Microsoft 365 Attacks(opens the original post in a new tab)
- iThome (Taiwan)Chinese hacker group Storm-0940 uses its own AI framework ARTEX to launch large-scale attacks and leverages ConnectWise credentials to penetrate corporate clouds
Microsoft released a research report on October 21 attributing large-scale automated attacks using the open-source AI penetration testing framework ARTEX to the China-backed hacking group Storm-0940, saying it has attacked hundreds of organizations worldwide and in some cases gained high-privilege access to corporate cloud environments in less than 3 hours. Microsoft also attributed the ConnectWise Cloud Backup supply chain intrusion to this group; the attackers used stolen application credentials to attempt logins to more than 2,250 Microsoft 365 tenants, and at one point generated more than 200 login records with 4 sets of credentials in less than 4 minutes. Microsoft observed that between October 10 and 14, Storm-0940 conducted password spraying attacks against 327 accounts of 8 organizations, with more than 151,000 cumulative failed logins; nearly 98% of login attempts received account lockout responses, and no successful logins were observed.
- WebAI Threat Watch (aithreat.io)· Media coverageMicrosoft vincula IA china al hackeo de 2.250 empresas(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageChinese Hackers Use AI Agents to Breach Thousands of Companies via ConnectWise(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageConnectWise piraté : des hackers chinois utilisent l'IA pour attaquer des milliers d'entreprises(opens the original post in a new tab)
- X@grok· DiscussionIn Chinese, as written@WuYou20230501 @shoetsusato 微软已官方确认：与中国有关联的黑客组织Storm-0940，使用AI工具ARTEX对全球数百机构发动大规模攻击。新闻有据可查，并非造谣。对方关于“第三次世界大战”和制裁的表述，属于个…(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageКража данных. Китайские хакеры атаковали 2250 организаций через взлом ConnectWise(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)· Media coverageChina APT Uses AI Pentest Tool Artex in ConnectWise Attacks(opens the original post in a new tab)
- GIGAZINESelectedMicrosoft says China-government-linked Storm-0940 used AI agent ARTEX to attack hundreds of organizations worldwide
Microsoft published the findings of its investigation into the hacker group Storm-0940, saying that since September 2026 it has used the AI agent ARTEX to attack hundreds of organizations worldwide, including automakers, financial institutions, government agencies and semiconductor manufacturers. ARTEX is an AI-driven framework that can autonomously carry out penetration-testing tasks from target information gathering to data theft. Microsoft said the group attempted logins against more than 2,250 targets at a rate of 2,900 login attempts per minute, that some attacks achieved privileged access within three hours of the target being identified, and that ARTEX was observed being used to attack ConnectWise's IT management system. Microsoft advised administrators to check for activity since October 15, 2026, with records going back to October 1 where available, and to review Microsoft 365 audit records.
- Security AffairsMicrosoft attributes ConnectWise intrusion to China-linked group using AI penetration testing tool ARTEX
Microsoft released a technical report attributing the ConnectWise Cloud Backup supply chain intrusion to the China state-linked group Storm-0940, stating that it used the open-source AI penetration testing framework ARTEX to reach 2,250 Microsoft 365 tenants. The report states that during the password spraying phase from October 10 to 14, more than 151,000 failed logins were launched against 327 accounts at 8 organizations, peaking at 2,900 per minute, all unsuccessful. After obtaining credentials for a ConnectWise cloud application account on October 15, the agent switched to logging in directly through the already authorized application without user interaction, and in some environments entered Microsoft Graph to conduct directory reconnaissance and modify application credentials to establish persistent backdoors; Microsoft states that such modifications may remain effective after the original application is remediated. Microsoft states that in some attacks, less than 3 hours elapsed from initial positioning to obtaining cloud privileged access.
- Dark ReadingMicrosoft links Storm-0940 to ConnectWise supply chain attack
Microsoft links the China-linked hacking group Storm-0940 to the ConnectWise supply chain attack. The group used an AI-driven penetration testing tool to automate and accelerate attacks, hitting more than 2,200 tenants.
- TechCrunch AIMicrosoft says China state–aligned hackers surveilled thousands of businesses after breaching IT giant ConnectWise
Microsoft security researchers say China state–aligned hackers breached the cloud backup service of IT management and remote access giant ConnectWise, stealing application credentials used to connect ConnectWise with enterprise customers, then logging in as authorized users to customers' Microsoft hosted environments and accessing their email and other files. According to Microsoft's count, the hackers, using AI agents, broke into about 2,250 organizations at a rate of nearly 3,000 login attempts per minute, a speed Microsoft says leaves defenders almost no time to detect and respond. Microsoft attributes the accelerated attack to the open-source AI framework ARTEX, which works with AI models to stress-test cyber defenses; the same AI software was also used in a recent breach of South Korean financial systems, many of which had weak security and lacked multi-factor authentication. ConnectWise has suspended access to the cloud backup system and opened an investigation, and as of Thursday was still restoring service.
- Infosecurity MagazineMicrosoft: Chinese state actor used AI to breach ConnectWise tenants
Microsoft says it observed threat actor activity in multiple ConnectWise customer environments, where attackers exploited the ARTEX agentic AI platform; Microsoft attributed the activity to a Chinese state actor.
- Voice of AmericaMicrosoft: China-linked hackers used superintelligence to attack hundreds of organizations worldwide
Microsoft's security research and threat intelligence team said that the China state-linked hacking group Storm-0940 used the AI penetration tool ARTEX in September this year to launch automated attacks on hundreds of organizations worldwide, with some attacks giving it privileged access to cloud infrastructure. The report said that in multiple attacks, less than three hours passed from initial targeting to obtaining privileged access, and that targets spanned aerospace, defense, automotive, energy, financial services, government, media, semiconductors and think tanks. Microsoft also linked the group to a supply chain compromise of ConnectWise's multi-tenant application; ConnectWise CEO Rivero said the affected application connections had been disabled and are being restored in phases, but unauthorized access that may already have been established within customer tenants must be checked one by one. ARTEX was originally used to test network and system security and can combine different AI models to automatically carry out network reconnaissance, vulnerability probing and data theft. A spokesperson for the Chinese Embassy in the United States told Reuters that China opposes and cracks down on illegal hacking activities, and also opposes using cybersecurity issues as a pretext to smear and attack China.
- The Hacker NewsSelectedChina-linked hackers used the ARTEX AI agent in the ConnectWise supply chain attack
Microsoft disclosed that the China-government-aligned hacking group Storm-0940 was behind the recent ConnectWise cloud backup supply chain attack and used ARTEX, a Go-language agentic AI penetration testing framework, to
- Guang Ming Daily (Malaysia)Microsoft says "pro-China" hackers used AI to attack, hundreds of organizations worldwide targeted
Microsoft said on Wednesday (the 21st) that a hacker group "aligned with the Chinese government's position" used an AI-driven penetration testing tool to breach information services company ConnectWise, and hundreds of organizations worldwide were targeted in this wave of attacks. According to Reuters, ConnectWise CEO Rivilo said that based on Microsoft's analysis and the evidence the company has, this attack against ConnectWise Cloud Backup "appears to have been carried out by an organization aligned with the Chinese government's position." Microsoft tracks the hacker group under the code name Storm-0940, which used an open-source penetration testing framework called ARTEX to launch this wave of cyberattacks; ARTEX allows users to use any AI model to automatically perform penetration testing work, and can also be configured to autonomously carry out multiple tasks such as reconnaissance and data theft. ConnectWise has disabled the affected application connections and is restoring services in stages, but Rivilo said these measures cannot eliminate the access permissions to customers' cloud systems that attackers may have already obtained, and each must still be checked one by one.
- ConnectWiseSelectedConnectWise disclosed unauthorized access to Cloud Backup (formerly SkyKick) application identities, with service disruption and phased recovery
ConnectWise disclosed that application identities in its Cloud Backup (formerly SkyKick) environment suffered unauthorized access; on October 17 it disabled 7 application identities and revoked the related certificates, suspended the three services Cloud Backup, SaaS Security and Cloud Management, and then restored them in phases. ConnectWise said that, based on threat intelligence shared by Microsoft, the attack appeared to come from a group aligned with the Chinese government that used publicly available agentic AI frameworks to automate and accelerate its operations; according to Microsoft research, the group has been active since 2021 and has also targeted aerospace, energy, finance, government and other sectors, and in some cases attackers obtained privileged cloud access within three hours. ConnectWise said existing backup archives remain encrypted and isolated with no signs of access, and there is no indication that other products were affected, but the investigation itself cannot determine whether the Microsoft 365 tenants of specific partners or customers were compromised, and each must investigate on its own.
- Date not givenAI Incident DatabaseMicrosoft discloses that Storm-0940 used the ARTEX agentic penetration testing framework to launch a large-scale nation-state supply chain attack
According to a Microsoft security blog, as early as September 2026, the China state-backed threat actor Storm-0940 used the agentic AI penetration testing framework ARTEX to automate attacks on hundreds of organizations worldwide, spanning a wide range of industries. Microsoft said this AI-driven large-scale nation-state attack campaign led to supply chain compromise.
- Date not givenAI Incident DatabaseMicrosoft says China-linked hackers breached ConnectWise, with global attacks targeting hundreds of organizations
Microsoft says a China state-linked hacking group it tracks as Storm-0940 used an AI-driven open-source penetration testing framework called ARTEX to breach IT services company ConnectWise, in a campaign targeting hundreds of organizations worldwide. Microsoft says ARTEX can call on any AI model to automate penetration testing tasks and can be configured to autonomously carry out reconnaissance and data exfiltration. Targeted sectors include aerospace, defense, energy, finance, government, military, semiconductors, think tanks and nonprofits; Microsoft says most targeted attacks were unsuccessful, but that Storm-0940 achieved privileged cloud persistent access at many organizations in a short time, meaning advanced permissions that may survive cleanup. ConnectWise CEO Manny Rivelo said that based on Microsoft's analysis and existing evidence, it appears a China state-linked group attacked ConnectWise Cloud Backup; the company has contained the affected application connections and is restoring service in stages, but this cannot remove unauthorized access that may already have been established within individual customer tenants, which requires separate review.
Related discussion
- WebAI Threat Watch (aithreat.io)Chinese AI model carries out complex cyberattacks in controlled tests, researchers say(opens the original post in a new tab)
- X@aniriddha · Red pill or blue pill?Microsoft says China aligned hackers used AI agents in the ConnectWise Cloud Backup attack. The group, Storm-0940, use…(opens the original post in a new tab)
1 comments·Oct 30 09:41Collect
- WebAI Threat Watch (aithreat.io)Microsoft: Storm-0940 через ConnectWise с ИИ взломала 2250 аккаунтов(opens the original post in a new tab)
- X@7D__Vision · 7D Vision🚨 CHINA-LINKED HACKERS ARE USING AI TO ACCELERATE CYBERATTACKS AGAINST U.S. CLOUD INFRASTRUCTURE. A trusted software p…(opens the original post in a new tab)
1 comments·Oct 30 06:34Collect
- X@ZeroDayDaily · ZeroDayDaily🚨 CONNECTWISE BACKUP IS BACK, BUT YOU HAVE TO RECONNECT EVERY TENANT. After the Storm-0940 breach, ConnectWise started…(opens the original post in a new tab)
1 comments·Oct 29 10:34Collect
- X@SBSentinellive · Sunny BurnsCHECKED — TRUE. Microsoft confirms a China-aligned group (Storm-0940) used the ARTEX AI framework against hundreds of o…(opens the original post in a new tab)
- X@simpatico_llc · Simpatico SystemsSource: Microsoft Security Research, October 21, 2026 https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-09…(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)Hackers Use AI Agents to Target Over 2,250 Microsoft 365 Tenants Through ConnectWise(opens the original post in a new tab)
- WebAI Threat Watch (aithreat.io)Hackers Abuse ConnectWise Cloud Backup Credentials to Launch AI-Driven Microsoft 365 Attacks(opens the original post in a new tab)
- Older than 72 hours · Not included in the 72-hour figures
- X@pobriendf · Philip Obrien | Backup e CibersegurançaOrientação da Microsoft: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-conn…(opens the original post in a new tab)
- X@pobriendf · Philip Obrien | Backup e CibersegurançaSegundo a Microsoft, a IA de um grupo alinhado à China levou menos de três horas do alvo ao acesso privilegiado na nuve…(opens the original post in a new tab)
1 likes · 2 comments·Oct 28 11:34Collect
- X@frknetm · Furkan EtemMicrosoft reports AI-assisted attacks reaching privileged cloud access in under 3 hours in some cases. For anyone buil…(opens the original post in a new tab)
Attention trend
New sources per day
- Oct 21: 1 new sources (1 outlets, 0 accounts)
- Oct 22: 143 new sources (7 outlets, 136 accounts)
- Oct 23: 134 new sources (5 outlets, 129 accounts)
- Oct 24: 19 new sources (0 outlets, 19 accounts)
- Oct 25: 7 new sources (0 outlets, 7 accounts)
- Oct 26: 9 new sources (0 outlets, 9 accounts)
- Oct 27: 4 new sources (1 outlets, 3 accounts)
- Oct 28: 1 new sources (0 outlets, 1 accounts)
- Oct 29: 3 new sources (0 outlets, 3 accounts)
- Oct 30: 0 new sources (0 outlets, 0 accounts)