Microsoft Says China-Linked Storm-0940 Used AI Pentest Tool Against Hundreds of Organizations

What happened

According to Microsoft's security report, Storm-0940 has been active since at least 2021. In this campaign the group used stolen application credentials — including a compromised API secret — to move from a trusted provider identity into customer cloud environments, attempting sign-ins across more than 2,250 linked tenants and peaking at about 2,900 attempts per minute. In some cases the attackers reached privileged access less than three hours after starting to target an organization.

ARTEX is an open-source Go-based penetration-testing framework that can plug into any AI model to automate reconnaissance, password spraying, OAuth abuse, credential changes and privilege modification without interactive logins. Microsoft says the group has used it since September 2026 against hundreds of organizations worldwide across aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and non-profits. ARTEX also appeared in earlier investigations of attacks on South Korean financial institutions.

Key facts

1. ConnectWise CEO Manny Rivelo said in a statement: "Based on Microsoft's analysis and evidence available to ConnectWise, it appears that a China state-aligned group was responsible for the attack." The company has contained the affected application connections and is restoring services in controlled phases, while warning that "those actions do not remove unauthorized access that may have already been established within individual customer tenants, which require separate review."
2. In a password-spraying phase from Oct 10 to 14, the attackers generated more than 151,000 failed logons against 327 accounts at eight organizations, peaking at about 2,900 failures per minute on Oct 11; no successful authentication was observed in that phase.
3. ConnectWise discovered the issue on Oct 14 and published its first security advisory on Oct 16; as of Oct 21 the affected application connections had been disabled and restoration was underway in phases, expected to take several days.
4. A Chinese Embassy spokesperson told Reuters that China "opposes and fights hacking activities in accordance with the law" and "opposes smears and attacks against China under the excuse of cybersecurity issues." Microsoft's attribution of Storm-0940 is its threat-intelligence assessment rather than an independently established legal finding; Microsoft also cautioned that successful authentication does not establish that customer data was accessed or stolen.