Microsoft says Chinese hackers used AI agents to attack hundreds of organisations worldwide

A China-linked hacker group used an AI tool called ARTEX to automate cyberattacks and gain deep access to company cloud networks globally, warns Microsoft.

In Short

• ARTEX automated password spraying and OAuth abuse from the campaign's outset
• Attackers made 2,900 sign-in attempts per minute across 2,250 systems
• Compromised networks automatically received persistent backdoors and top-level administrator privileges

Artificial intelligence is no longer just for writing emails or creating images. Cybercriminals are now using AI to launch fast and highly destructive cyberattacks. According to a new warning from Microsoft, a hacking group linked to China has used an AI-powered tool to break into hundreds of companies across the globe.

The hacker group, identified by Microsoft as "Storm-0940", used an artificial intelligence tool to automate their attacks. This gave them deep and high-level control over company cloud networks in less than three hours.

The ConnectWise Breach

The hackers did not attack the companies directly. Instead, they used a backdoor method known as a supply chain attack. They targeted ConnectWise, a popular IT services company, specifically focusing on its Cloud Backup service.

ConnectWise CEO Manny Rivelo said that a China-aligned group appears to be behind the attack. To stop the damage, ConnectWise paused the affected application connections and is now restoring services slowly. However, Rivelo warned that just stopping the connections does not automatically kick out the hackers if they have already established access inside a customer's network. Customers will need to review their systems separately.

The Chinese Embassy in Washington has not yet commented on the incident. However, the Chinese government regularly denies any involvement in cyber theft and hacking activities.

How the AI Tool Made It Worse

To carry out this massive campaign, the hackers used an open-source software called ARTEX. Normally, ARTEX is a legitimate penetration testing framework used by security professionals to find weaknesses in networks. However, Storm-0940 misused its AI capabilities to automate malicious tasks like scanning systems and stealing data.

Microsoft’s report explicitly states that Storm-0940 used the ARTEX AI tool to automate both the initial password spraying campaign and the subsequent OAuth application abuse. The AI was used right from the start to accelerate the password guessing at machine speed; it was not a traditional manual effort before they switched to AI.

They used the AI tool to abuse the trusted digital keys that ConnectWise already used to connect to Microsoft 365 accounts. Because these backup apps were already trusted, the hackers bypassed standard login screens completely.

The speed of the attack was terrifying. The AI tool fired off 2,900 sign-in attempts every minute, reaching over 2,250 different company systems. Once inside, the AI automatically scanned the networks, changed passwords to create permanent backdoors, and gave itself top-level administrator rights. Microsoft noted that the AI moved so quickly that human security teams could not keep pace, leaving defenders with little time to detect and respond.

Even though many attacks were stopped, the hackers still managed to gain long-lasting, high-level cloud access in several organizations.

Who Was Targeted?

The hackers cast a very wide net. Microsoft reported that the attack targeted a huge variety of sectors. This included aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks, and non-profit organizations.

What Companies Should Do Now

Microsoft and security experts are urging companies to take immediate action, even if the ConnectWise service is currently paused. Companies that use or have ever used ConnectWise Cloud Backup are advised to keep the connections disabled until official instructions are provided.

IT teams are also being asked to carefully check their Microsoft 365 security logs for any unusual sign-ins or suspicious new administrator roles that they did not create themselves. Finally, experts warn companies not to simply delete the affected apps. Instead, they should disable them. This helps preserve important digital evidence that security teams will need to investigate the breach properly.

- Ends