Why Did Chinese Hackers Use AI Agents to Target 2,250 Corporate Cloud Environments?

How fast can a cyberattack become?

Traditionally, hackers have needed to complete several stages before gaining meaningful access to a target organization.

They identify potential victims, investigate systems, locate vulnerable accounts, establish an initial foothold, and attempt to obtain additional privileges.

In the past, these processes were carried out largely by skilled human attackers.

Depending on the target, attackers might spend days or weeks gathering intelligence, testing different techniques, and preparing subsequent actions based on the access they had obtained.

Artificial intelligence is changing this process.

Once an attacker establishes an objective, AI agents can investigate systems, attempt authentication, examine additional attack paths, and perform multiple tasks simultaneously.

The attacks can continue even while their human operators are sleeping or resting.

A Microsoft security report published on October 21, 2026, illustrates how this transformation has begun appearing in real-world nation-state-linked cyber operations.

Microsoft security researchers reported that Storm-0940, a threat group the company assesses as linked to the Chinese state, used an AI-powered penetration-testing framework called ARTEX to automate attacks against hundreds of organizations worldwide.

In some attacks, the time between initial targeting and obtaining highly privileged cloud access was less than three hours.

A supply chain compromise involving ConnectWise's Cloud Backup service was particularly significant because AI agents helped increase the scale and speed of subsequent attack activity.

Microsoft observed more than 151,000 failed login attempts associated with the campaign.

At peak intensity, authentication attempts reached 2,900 per minute.

After credentials associated with a ConnectWise application were compromised, attackers attempted to access more than 2,250 customer tenants.

But this number does not mean that 2,250 companies were successfully compromised.

Microsoft said the vast majority of attack attempts were unsuccessful.

Whether customer data was actually accessed or exfiltrated must also be assessed separately for each affected environment.

The most important issue is therefore not simply the number of organizations successfully breached.

It is that AI agents accelerated attack operations while using permissions already granted to trusted third-party applications as a pathway for expanding access.

Who Is Storm-0940?

Storm-0940 is the name Microsoft uses for a China-linked cyber threat actor that has been active since 2021.

In Microsoft's threat intelligence naming system, the "Storm" designation is generally used for threat groups being tracked under provisional identifiers.

The group does not currently have a widely established alternative name used across major cybersecurity vendors.

According to Microsoft, Storm-0940 has conducted information-theft activities targeting organizations across multiple industries.

Its principal techniques include exploiting vulnerabilities in internet-facing applications and conducting password-spraying attacks.

Password spraying involves repeatedly testing a small number of commonly used passwords across many accounts.

Unlike traditional brute-force attacks that concentrate numerous password guesses on one account, password spraying seeks to test authentication across a broad population of accounts while reducing the likelihood of triggering account-lockout controls.

Storm-0940 has previously used compromised account credentials and cloud-application credentials to expand access to additional systems.

Microsoft has also observed techniques involving the addition of new credentials to existing OAuth applications to maintain persistent access.

OAuth is an authorization framework that allows users to grant external applications access to specific services without directly sharing their passwords.

Many enterprise applications integrated with Microsoft 365 use this structure.

Under normal circumstances, it improves convenience and enables business automation.

But if the credentials of an external application are compromised, the permissions granted to that application can become an attacker's route into connected systems.

Storm-0940 has begun automating these established techniques with AI.

Microsoft said it identified ARTEX-related attack activity dating back to at least September 2026.

Targeted sectors included aerospace and defense, automotive, chemicals, energy, finance, government, legal services, manufacturing, media, military organizations, semiconductors, software, technology, think tanks, and nonprofit organizations.

The activity was not limited to one industry.

It represented a broad effort to examine the interconnected infrastructure of cloud platforms and enterprise software.

What Is ARTEX? An Attack-Orchestration System, Not an AI Model

ARTEX is not an independent large language model.

It is an open-source framework designed to automate penetration-testing activities by coordinating multiple AI models and agents.

Its architecture combines a multi-agent system written in Go with a user interface built on Next.js.

Rather than depending on a single AI model, the framework can work with different language models.

Its central feature is the distribution of penetration-testing tasks among multiple AI agents.

Agents investigate target systems, identify accessible assets, analyze vulnerabilities and authentication paths, and select subsequent actions based on collected information.

Discovered assets and vulnerabilities are accumulated in a graph that preserves relationships between them.

Information gathered during one stage becomes the basis for decisions made during later stages.

Legitimate penetration testing involves security professionals assessing an organization's vulnerabilities with authorization.

But attackers can misuse similar automation technologies to gain unauthorized access.

This is the dual-use nature of ARTEX.

Technology developed for defensive security automation can become an offensive instrument depending on who operates it and whether they have permission.

Microsoft explained that ARTEX can automate multiple stages of an attack, from reconnaissance to potential data exfiltration, without requiring human intervention at every step.

However, the capabilities offered by a framework must be distinguished from the actions actually observed in this campaign.

The confirmed activities included broad scanning and reconnaissance, authentication attempts, attempts to access customer environments through a compromised OAuth application, and efforts to modify permissions or establish persistence in certain environments.

Microsoft also referenced public reporting that ARTEX had been used in attacks associated with a personal-data breach at a South Korean financial institution.

This suggests that the misuse of AI-powered penetration tools may not be limited to one threat group or country.

2,900 Authentication Attempts per Minute: The Speed of Attack Is Changing

Among the most striking figures in Microsoft's report are the scale and speed of automated authentication activity.

Between October 10 and 14, infrastructure associated with Storm-0940 conducted automated authentication attacks against Microsoft 365 and Exchange Online.

The activity targeted 327 accounts belonging to eight organizations.

Microsoft recorded more than 151,000 failed login attempts.

On October 11 alone, more than 111,000 failures were concentrated within a single day.

The peak rate reached 2,900 attempts per minute.

Forty-eight accounts each experienced more than 1,000 failed attempts.

Approximately 98% of the recorded activity resulted in account-lockout responses.

An important distinction must be made here.

Microsoft said it did not observe successful authentication, token issuance, Microsoft Graph calls, or directory modifications resulting from this particular password-spraying activity.

The figure of more than 151,000 therefore represents failed authentication attempts, not successful intrusions.

Nevertheless, the implications are significant.

With AI and automation tools, attackers can test large numbers of potential targets in short periods.

Of course, large-scale authentication automation did not originate with AI.

Traditional scripts and bots have been capable of similar activity for years.

What AI adds is not simply the ability to send more login requests.

It is the ability to coordinate the exploration of attack paths, interpret results, and connect subsequent actions within a single framework.

Some of the work previously requiring human attackers to operate separate tools and review intermediate results can now be delegated to agents.

This could substantially increase the number of targets and operations an attacker can manage simultaneously.

Microsoft reported that some attack sequences progressed from initial targeting to highly privileged cloud access in less than three hours.

For defenders, that means the available response window may be shrinking.

What Was Compromised at ConnectWise?

ConnectWise sits at the center of this incident.

The company provides software for IT management, remote operations, backup, and other enterprise services used by businesses and managed service providers.

The affected service was Cloud Backup, formerly known as SkyKick.

The service connects to customers' Microsoft 365 environments to back up and manage cloud data.

To function properly, ConnectWise applications receive specific permissions within those customer environments.

The problem arose when attackers obtained credentials associated with such an application.

On October 16, ConnectWise published a security advisory stating that it was investigating unauthorized access to application credentials associated with Cloud Backup.

Microsoft assessed the supply chain compromise as linked to Storm-0940's activities.

Attackers subsequently used compromised ConnectWise application credentials to attempt access to customers' Microsoft 365 environments.

In effect, customers that had previously trusted the ConnectWise application and granted it access became potential targets through that existing relationship.

This is where the incident differs from a conventional employee-account compromise.

An attacker may not need to steal the credentials of individual employees if it can misuse the credentials of an application already authorized to access the organization's environment.

Such access can occur through the application's own identity without requiring an ordinary user login.

In cloud environments, this is commonly known as application-only authentication or service principal authentication.

A trusted application identity had become an attack path.

What Do Attempts Against 2,250 Customer Tenants Actually Mean?

According to Microsoft, after obtaining ConnectWise application credentials, Storm-0940 used ARTEX to attempt access to more than 2,250 customer tenants.

A tenant is a logically separate administrative environment within a cloud service such as Microsoft 365, containing an organization's users, data, applications, and access permissions.

The figure of 2,250 tenants does not mean that the same number of distinct companies were successfully compromised.

It describes the scope of customer cloud environments targeted by access attempts.

Microsoft did observe post-authentication activity in some customer environments.

Attackers used Microsoft Graph to investigate organizational resources and permissions.

Microsoft Graph is an API interface that allows applications to access and manage Microsoft 365 users, groups, email, files, applications, and other organizational resources.

Legitimate applications use Microsoft Graph to automate authorized business activities.

But attackers who obtain credentials for highly privileged applications can misuse the same interface.

Microsoft reported activity involving changes to application credentials, attempts to expand privileges, and modifications involving users, groups, and privileged directory roles in certain environments.

Such actions may indicate attempts to maintain access beyond an initial intrusion.

Adding new credentials to an existing application is particularly concerning.

Even if the originally compromised credentials are revoked, an attacker may retain access through newly established authentication paths.

Incident response may therefore require more than simply rotating the original credentials.

Defenders also need to examine newly added credentials, permission changes, and newly created service principals.

However, Microsoft emphasized that the presence of a compromised application or even successful authentication does not automatically establish that customer data was exfiltrated.

Actual data access and data theft must be investigated separately within each customer environment.

Why Supply Chain Attacks Become More Dangerous When Combined with AI

A supply chain attack compromises a software or service provider used by the ultimate target rather than attacking that target directly.

Modern businesses depend on numerous external services.

These include backup platforms, security tools, customer relationship management systems, collaboration applications, and HR software.

To perform legitimate functions, external applications often need access to enterprise systems and data.

A backup application must be able to read data.

An automation tool may need access to user accounts and files.

These permissions are necessary for the services to operate.

But if a provider's credentials are compromised, the implications change dramatically.

One compromised supplier may create opportunities to access many customer environments.

Attackers do not necessarily need to defeat each customer's security controls from the beginning.

They can exploit connections and permissions that have already been authorized.

AI agents can potentially accelerate this process.

They can test which customer environments accept the compromised credentials, investigate environments where access succeeds, and automatically continue subsequent operations.

Where a human attacker might investigate only a few environments at a time, AI agents can process multiple targets in parallel.

As the number of potential targets grows, the economic advantages of automation become greater.

The ConnectWise incident illustrates how this structure can operate in practice.

However, it would be incorrect to conclude that AI itself caused the original supply chain compromise.

Microsoft's analysis focuses on Storm-0940's use of ARTEX to accelerate several attack activities.

The precise mechanism through which ConnectWise's credentials were initially compromised remains a separate investigative question.

Nor should the incident be interpreted as proof that AI independently executed every stage of the intrusion.

Why Is It Difficult to Stop an Attack Even When Security Alerts Are Triggered?

Large-scale authentication attempts can be detected by security systems.

Thousands of login requests per minute can produce patterns that differ significantly from ordinary business activity.

Microsoft's published records contained substantial numbers of authentication failures and account-lockout events.

Such events can provide useful signals for security monitoring.

But detection and response are different things.

When an alert appears, security analysts must determine whether the activity represents an actual attack.

They must identify affected accounts and applications, assess potential operational consequences, and decide which containment measures are appropriate.

Meanwhile, the attacker may already have moved to another stage.

Microsoft's observation that privileged access was obtained within three hours in some cases illustrates this timing problem.

When attackers rapidly connect reconnaissance, authentication, and follow-on actions, the intrusion can expand while defenders are still triaging alerts.

Supply chain incidents make the problem even more complicated.

Disabling an application connected to an external backup service may interrupt legitimate business operations.

But leaving the connection active may allow attackers to continue exploiting it.

Security teams must balance business continuity against the need to prevent further compromise.

The growth of AI-assisted attacks therefore creates new requirements for security operations.

It is no longer sufficient merely to identify incidents after they have occurred.

Organizations need to detect credential misuse and permission changes quickly and prepare automated response procedures.

Yet defensive automation is not automatically the correct answer in every situation.

If an automated system mistakenly blocks a critical application or deletes important data, it can cause a separate operational incident.

The real issue is not automation itself.

It is defining in advance which actions are permitted under which conditions.

The Attackers Entered Through an Application Identity, Not a Human Account

Perhaps the most important question raised by this incident is simple.

Who actually logged in?

Traditional enterprise security has often focused on human user accounts.

Organizations protect usernames and passwords, enforce multifactor authentication, and generate alerts when unusual logins occur.

But humans are not the only entities that authenticate in cloud environments.

Business applications and automated systems also use credentials to access other services.

External applications integrated with Microsoft 365 can perform authorized operations without requiring users to log in for every action.

This is one of the foundations of enterprise automation.

In the ConnectWise incident, however, that trust structure became an attack path.

Using compromised application credentials, attackers could access cloud environments without going through ordinary human user authentication.

Even when multifactor authentication protects employees' accounts, it does not automatically secure separately authorized application authentication paths.

Organizations therefore need to manage application identities as critical security assets alongside human accounts.

They should regularly review which applications can access which systems and data.

They must determine whether applications possess unnecessarily broad permissions and whether obsolete connections remain active.

Particular scrutiny is necessary when external providers are granted highly privileged access.

This incident illustrates how identity security is expanding beyond employees to software applications and AI agents.

How Did ConnectWise Respond?

After disclosing the Cloud Backup security incident on October 16, ConnectWise began blocking affected application connections and preparing service recovery.

On October 17, the company disabled relevant application identities.

ConnectWise also suspended Cloud Backup and, as a precaution, related SaaS Security and Cloud Management services.

These actions were intended to prevent additional unauthorized access.

But they also created disruptions for legitimate customers.

Backup services are particularly sensitive because customers may need restoration capabilities during an incident.

ConnectWise began working with external security specialists to investigate the compromise, reset accounts and credentials, and restore affected environments in stages.

In an October 24 update, the company said validation of the recovery environment and certificate replacement activities were continuing.

It also identified October 26 as a target for restoring access to existing backup restoration capabilities, subject to successful completion of security verification.

ConnectWise stated that existing backup archives had been preserved separately in encrypted form and that it had not identified evidence of compromise affecting those archives at that point.

It is therefore important to distinguish between compromised application credentials and confirmed theft of backup data.

The incident demonstrates that supply chain security problems can directly affect customers' operational continuity.

Even when disconnecting an external service is necessary for security, customers may temporarily lose access to backup, recovery, or security-management functions on which they depend.

What Should Businesses Check Now?

Microsoft recommended that organizations associated with ConnectWise keep affected application connections disabled until official recovery guidance permits restoration.

It also advised organizations to investigate not only applications currently installed but also historical installations and permissions.

Even if a business believes it no longer uses an application, service principals or previously granted permissions may remain in its cloud environment.

Checking application names alone is not sufficient.

Microsoft recommended verifying connections and permissions using the actual application identifiers.

Investigations should examine service principal sign-in logs, Microsoft Graph activity, changes to application credentials, added permissions, and the creation of new service principals.

Particular attention should be paid to new credentials or elevated privileges added to existing applications.

Organizations need to determine whether such changes resulted from legitimate administration or unauthorized activity.

This is important because attackers may attempt to maintain alternative access paths after the original credentials are revoked.

However, immediately deleting affected applications may not always be appropriate.

Microsoft recommended preserving investigative records and configuration evidence before taking subsequent response actions.

These records are necessary to determine which permissions were used and what changes occurred.

The recommendations illustrate that AI-assisted attacks have not rendered traditional security principles obsolete.

Instead, they have increased the importance of applying those principles more quickly and thoroughly.

Least-privilege access, credential management, audit-log preservation, anomaly detection, and incident recovery remain essential.

What has changed is the speed at which attackers can identify and exploit weaknesses in these controls.

How Much Is AI Actually Changing Cyberattacks?

It would be an exaggeration to describe this incident as an example of AI independently conducting an entire hacking campaign without human involvement.

Storm-0940 was already an established threat group with operational experience and infrastructure.

Password spraying, abusing external applications, and gaining cloud privileges are all established attack techniques.

ARTEX was used to automate and scale these activities.

The fundamental principles of the attacks did not suddenly change.

What may be changing is the amount of time and labor required to conduct them and the number of targets that can be handled simultaneously.

AI can take over portions of reconnaissance and analysis that previously required skilled attackers.

Once an attack path has been identified, it can potentially be applied rapidly across multiple environments.

AI agents can also perform multiple activities in parallel, increasing the pace of operations.

This could change the economics of cyberattacks.

If attackers need fewer personnel and less time per target, they may have greater incentives to test much larger populations of potential victims.

Defenders, meanwhile, must identify genuinely dangerous activity among enormous volumes of alerts.

The important transformation is not that AI has suddenly made previously impossible hacking techniques possible.

It is that AI can make already feasible attacks faster and more scalable.

Cybersecurity Competition Is Becoming a Race Between Human and AI Response Speeds

Enterprise security operations have historically developed around the analysis and judgment of human experts.

Security systems detect anomalies and generate alerts.

Security professionals evaluate the severity of those alerts and decide whether to block access, investigate, or initiate recovery.

But when AI agents rapidly connect different attack stages, a new stage may begin before analysts finish examining the previous one.

Microsoft emphasized this problem in its report.

Large-scale automated attacks can generate extensive records and may therefore be detectable.

But the time available for defenders to respond after detection can be very short.

Organizations may consequently need to invest in AI-assisted defensive automation.

However, defensive systems also require careful controls and validation.

An automated system that incorrectly blocks permissions or external application access can disrupt legitimate enterprise operations.

As both attackers and defenders use AI, effective cybersecurity will require not only faster decisions but also precise permission management and safe automation.

This is more than a competition over the performance of individual security products.

It concerns how securely organizations design the operational systems connecting cloud infrastructure, external applications, identities, permissions, and business continuity.

The Real Danger Lies Not Only in AI, but in Permissions Already Granted

The essence of this incident is not simply how sophisticated AI-powered attacks have become.

An equally important factor is that the ConnectWise application had already been granted permissions to access customer environments.

Attackers could exploit existing authorized access rather than obtain every privilege from scratch.

AI agents accelerated the process of using those permissions.

This has direct implications for companies pursuing digital transformation and AI transformation.

Businesses connect increasing numbers of systems to automate work.

They provide data to external SaaS platforms, connect AI agents to enterprise tools, and authorize applications to interact with other systems on their behalf.

These connections improve productivity.

But they also increase the potential consequences if a credential or application identity is compromised.

Security in the AI era therefore cannot focus exclusively on whether each individual service is secure.

Organizations must examine the trust relationships between services.

Who can access which systems?

What permissions do they possess?

And how far could an intrusion spread if those permissions were compromised?

Permissions granted to external providers deserve continuous scrutiny.

Organizations should reconsider whether the high-level privileges required when a service was first introduced remain necessary.

Unused integrations and outdated credentials should be removed.

Applications accessing critical business systems should receive only the minimum permissions required to operate.

These are fundamental security principles that existed long before AI.

But as attack automation advances, the consequences of failing to apply them may become faster and more widespread.

What Must Businesses Change as AI Automates Hacking?

Microsoft's report illustrates a new reality confronting the cybersecurity industry.

A China-linked threat group used ARTEX to automate large-scale attack activity.

Attackers attempted access across thousands of cloud environments and obtained elevated privileges in some of them.

Many attempts were unsuccessful.

Nevertheless, the expansion of attack activity into customer cloud environments through a compromised external application is significant.

In certain environments, investigators observed follow-on actions involving reconnaissance, credential changes, privilege escalation, or attempts to maintain persistent access.

The incident shows that AI does not need to invent entirely new attack techniques to become dangerous.

Existing vulnerabilities, excessive permissions, and poorly managed credentials can already create substantial risks.

AI can make those weaknesses faster to discover and exploit.

This lesson also applies to organizations adopting AI agents.

Granting AI powerful business permissions may improve productivity, but businesses must also consider what happens if those permissions are misused.

As AI performs more work, organizations need to manage not only employee identities but also application and agent permissions.

They must reassess every trust relationship involving external services.

Microsoft's report shows that AI-assisted cyber operations are already intersecting with real-world supply chain security failures.

But the most important question is not how sophisticated the AI used by Chinese hackers has become.

It is how much authority businesses have entrusted to external applications.

How quickly can they detect and contain an intrusion when those permissions are compromised?

And have they designed their systems so that the compromise of one supplier cannot spread across an entire customer ecosystem?

Attackers are moving faster with AI.

Defenders must respond faster, but they must also reduce the permissions and trust relationships that allow attacks to spread in the first place.

The central challenge of cybersecurity in the AI era is not simply acquiring defensive AI that can move faster than hackers. It is designing systems in which even a rapidly automated attack cannot turn a single compromise into an intrusion affecting thousands of customer environments.

The Storm-0940 and ARTEX campaign illustrates why that distinction matters.