Microsoft has warned that a China state-aligned hacking group used an artificial intelligence-powered penetration testing framework to conduct large-scale cyberattacks targeting hundreds of organisations worldwide, including customers of IT services provider ConnectWise.
According to research published by Microsoft Threat Intelligence on October 21, 2026, the group, tracked as Storm-0940, used an open-source agentic AI framework called ARTEX to automate reconnaissance, password spraying and attempts to gain access to cloud environments.
The campaign targeted organisations across multiple sectors, including aerospace, defence, financial services, government, manufacturing, technology and media.
Microsoft said several attacks resulted in privileged access to cloud infrastructure, with some incidents progressing from initial targeting to elevated access in less than three hours.
The findings indicate how AI-assisted automation can accelerate established cyberattack techniques, reducing the time available for security teams to detect suspicious activity and respond.
Storm-0940, which Microsoft has tracked since 2021, has previously used password spraying and vulnerabilities in internet-facing applications to gain access to organisational systems.
In its latest activity, the group used ARTEX to automate scanning, authentication attempts and the misuse of OAuth applications, which can provide access to cloud services through authorised permissions.
Microsoft linked the group to the recently disclosed ConnectWise supply chain compromise, which involved unauthorised access through application identities.
During the campaign, attackers attempted to access more than 2,250 customer tenants at a rate of approximately 2,900 sign-in attempts per minute.
Between October 10 and 14, Microsoft recorded more than 151,000 failed authentication attempts targeting 327 accounts across eight organisations.
The company noted that the majority of attempted attacks were unsuccessful. It also clarified that successful authentication or the presence of an affected application did not necessarily indicate that customer information had been accessed or stolen.
ConnectWise reported taking steps to contain affected application connections and restore services in controlled phases.
A spokesperson for the Chinese Embassy in Washington rejected the allegations, maintaining that China opposes hacking and the politicisation of cybersecurity issues.
Microsoft's research also identified the use of ARTEX by threat actors in other geographical regions, indicating that automated offensive security tools are not limited to one group.
For enterprises, the findings highlight security challenges associated with AI-driven attacks, particularly where organisations rely on interconnected cloud applications and third-party service providers.
Microsoft advised customers to review service principal sign-ins, investigate unexpected changes to application credentials and permissions, and monitor suspicious activity involving Microsoft Graph.
The company also recommended following ConnectWise's containment guidance and preserving relevant evidence during investigations.
The disclosure comes as organisations increasingly adopt AI-powered systems while cybersecurity teams assess how automated attacks could affect identity management, cloud security and incident response.
Disclaimer: This article may include information derived from interviews, press releases, public statements, research, company communications and other publicly available or third-party sources. Such material may be summarised, paraphrased or contextualised for journalistic and editorial purposes. All rights in third-party content remain with their respective owners.