Microsoft has issued a stark warning regarding a sophisticated, AI-powered cyberattack campaign orchestrated by a China-linked hacking group identified as Storm-0940. The group is accused of using advanced AI tools to automate attacks on thousands of corporate cloud environments, primarily targeting systems through trusted ConnectWise applications.
According to Microsoft's findings, the attackers employed an open-source AI penetration-testing framework named ARTEX to accelerate their malicious activities. This framework enabled the group to automate login attempts at an unprecedented rate, reportedly reaching up to 2,900 attempts per minute.
How the AI-Assisted Attack Unfolded
The campaign, which Microsoft believes began around September 2026, saw Storm-0940 first gain control of identities tied to various ConnectWise cloud applications. Leveraging the existing trust relationships of these applications, ARTEX's AI agents were then used to sign into customer tenants without requiring interactive user sign-ins. While over 151,000 sign-in attempts failed, the sheer volume and speed significantly increased the threat actor's efficiency.
Microsoft reported that some organizations experienced unauthorized cloud access within a mere three hours of initial targeting. In certain cases, the attackers went further, adding new application credentials to maintain persistent access and attempting to alter permissions to gain greater control. One particularly alarming instance involved an application assigning itself the 'Global Administrator' role, granting extensive administrative control over a Microsoft cloud environment.
Impact and Mitigation
ConnectWise disclosed attempts at unauthorized access in its Cloud Backup environment in an advisory published on October 16. This incident underscores the escalating threat posed by AI-powered automation, which dramatically increases the speed and scale of cyberattacks, leaving less time for detection and response.
Microsoft advises organizations to immediately investigate any suspicious application sign-ins, meticulously review unexpected changes to credentials and privileges, and adhere strictly to ConnectWise's containment guidance to protect their cloud environments from similar future threats.