Microsoft: China-linked hackers used AI agents to breach 2,250 tenants

The latest:

A nation-state group tracked as Storm-0940 ran AI agents that carried out intrusions from reconnaissance through data theft with minimal human input, Microsoft said in research published on 21 October 2026. The company attributes the group to China and says it has been active since 2021. Microsoft added that the activity did not stem from any flaw in its own products or services.

Details:

• The tool: ARTEX is an open-source penetration-testing framework built as a multi-agent system running on large language models, according to Microsoft. It is written in Go with a Next.js interface, can be pointed at any AI model, and its agents build a map of discovered assets and vulnerabilities as they work.
• The scale: Microsoft said Storm-0940 began using ARTEX in September 2026 to automate attacks against hundreds of organizations worldwide. The company did not name the affected organizations or break the figure down by country.
• The numbers: Between 10 and 14 October 2026, infrastructure at 144.172.64.99 ran a cross-tenant password-guessing campaign against 327 accounts at 8 organizations, Microsoft said. It logged more than 151,000 failed sign-in attempts, peaking near 2,900 failures per minute on 11 October, with no successful logins.
• The supply chain: The ConnectWise Cloud Backup application was compromised in parallel, with public reporting on 15 October and a ConnectWise advisory on 16 October. Microsoft said indicators of compromise matched the same address range used in the password-guessing campaign.
• The access: Using credentials stolen from ConnectWise application identities, the attackers reached more than 2,250 tenants without interactive sign-in, Microsoft said. In some environments they moved deeper into Microsoft Graph for reconnaissance and altered application credentials to maintain persistence.
• The escalation: Microsoft recorded attempted changes to identities, groups and privileged roles in affected environments. Several ARTEX-driven attacks obtained privileged access to cloud infrastructure, in some cases less than 3 hours after targeting began.
• The targets: Sectors hit include aerospace and defense, automotive, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, and think tanks and non-profits, according to Microsoft. No Gulf state was named.
• Microsoft’s framing: The company said most of the targeting was unsuccessful and that no breach or vulnerability in Microsoft systems, products or services caused the activity. It also said Storm-0940 achieved persistent privileged positioning inside many organizations.
• Wider use: Microsoft noted public reporting in October 2026 pointing to other actors adopting ARTEX, including a personal-data breach targeting Korean financial institutions, and said it has observed multiple actors across regions using the framework.
• The speed problem: Microsoft wrote that agents are not constrained by factors affecting humans, and said the pace of the activity “allows very little time for Defenders to respond.”

Background:

Microsoft has tracked Storm-0940 since 2021. The designation is an internal label for a threat cluster whose activity Microsoft attributes to China; this month’s research marks the group’s shift from conventional intrusion tooling to an agent-driven framework.

Between the lines:

The two strands reported by Microsoft point in different directions. The brute-force campaign produced 151,000 failures and no successful logins, while the stolen ConnectWise application credentials opened more than 2,250 tenants without any interactive sign-in. That contrast suggests volume was not what made the operation effective — the supply-chain path was. The sub-three-hour window to privileged access is what turns speed into a defensive problem, by Microsoft’s own account.

What’s next

Watch for further ConnectWise advisories on the scope of the Cloud Backup compromise, additional Microsoft indicators tied to the 144.172.64.99 range, and reporting on whether other actors adopting ARTEX replicate the supply-chain route.