Microsoft says a China state-aligned hacking group handed much of its job to an AI system. Based on the results, the system was a fast learner.
In a report released October 21, 2026, Microsoft Threat Intelligence tied the threat actor it tracks as Storm-0940 to a sprawling campaign run through ARTEX, an AI-driven penetration-testing framework. In some incidents, the group reportedly moved from a first foothold to elevated cloud privileges in less than three hours.
How the campaign worked
ARTEX takes the penetration-testing concept and automates it with AI. According to Microsoft’s findings, Storm-0940 used it to run several attack phases on autopilot, including reconnaissance and exploitation, across hundreds of organizations.
The research describes one operation that ran from October 10 to 14 and targeted 327 accounts using ARTEX.
The campaign then exploited a ConnectWise supply chain compromise that took place October 15-16, 2026, and ConnectWise publicly acknowledged the breach on October 16.
Through that opening, attackers abused OAuth application identities. Storm-0940 used those identities to fire off authentication attempts at a rate of 2,900 sign-in attempts per minute. Microsoft linked the group to abuse affecting more than 2,250 tenants.
A tool with two faces
ARTEX was not built as a weapon. It was released in July 2026 for legitimate security testing, then went closed-source in October 2026 following reported misuse.
Before the ConnectWise attack, the framework was linked to data breaches affecting roughly 68,000 individuals at South Korean financial institutions.
Storm-0940 itself is no newcomer. Microsoft’s research places the group’s activity back to at least 2021.
Why the three-hour figure matters
Speed is the headline risk here. Traditional defense assumes there is some window between an intruder getting in and that intruder doing real damage. If an AI-driven framework can collapse it to under three hours, human response times start looking inadequate.
The research also raises questions about the security posture of cloud platforms built on multi-tenant architectures. ConnectWise sits in exactly that kind of connective position, and the supply chain compromise opened doors at many downstream customers simultaneously.
What defenders should watch
Microsoft’s practical guidance focuses on service principal sign-ins. These non-human accounts often hold broad permissions, which makes them a quiet but valuable target. Microsoft’s report includes an overview of indicators of compromise alongside Defender detections intended to help organizations catch similar activity.
For security teams, the immediate checklist includes auditing which third-party apps hold OAuth permissions, monitoring service principal activity for unusual volume, and treating sudden bursts of authentication attempts as an alarm. A rate like 2,900 sign-in attempts per minute should be hard to miss.
ARTEX moving to closed-source after reported misuse shows how hard it is to keep dual-use security tools in the right hands once they circulate. Developers of AI-driven testing frameworks may face growing pressure to build in usage controls from day one rather than after an incident.
Disclosure: This article was edited by Diego Almada Lopez. For more information on how we create and review content, see our Editorial Policy.