AI-Powered hackers, 2,900 attempts a minute: Microsoft blames China-linked group for AI-assisted ConnectWise cyberattack

In a recent cyberattack incident, Microsoft has accused a Storm-0940, China-aligned hacking group of using AI-powered tools to automate a cyberattack targeting more than 2,250 corporate cloud environments through trusted ConnectWise applications. According to a company blog post, the hacking group used an open-source AI penetration-testing framework called ARTEX to automate login attempts.

According to Microsoft, the attackers first took control of identities tied to several ConnectWise cloud apps. ARTEX's AI agents then used the trust those apps already held to sign in to customer tenants, at speeds of up to 2,900 attempts a minute. More than 151,000 sign-ins failed. As a result of the attack, some organisations have suffered major impacts. Microsoft highlighted two instances, adding credentials for persistence and altering permissions to gain greater control.

Must read: AI agents powered by Claude, Grok, Kimi allegedly target 400 banks in Latin America

How did the AI-powered attack work?

Microsoft detailed that Storm-0940 first gained control of identities associated with multiple ConnectWise cloud applications. As mentioned above, the AI accessed customer environments through applications that already had access permissions, and ARTEX used AI agents to carry out malicious security workflows that could potentially reduce the time required to identify targets, attempt access, and pursue further activity.

Microsoft said some organisations experienced unauthorised cloud access within three hours of initial targeting. In certain environments, the attackers also added application credentials to maintain access and attempted to change privileged roles. In one instance, an application assigned itself the Global Administrator role, which provides extensive administrative control over a Microsoft cloud environment.

Must read: Google Chrome will ask before opening HTTP websites, adding a new layer of security to keep you even safer

The company further stated that the activity was part of a campaign that began around September 2026, when Storm-0940 automated attacks against hundreds of organisations globally. ConnectWise disclosed attempts at unauthorised access in its Cloud Backup environment in an advisory published on October 16.

This highlights how AI-powered automation can increase the speed and scale of cyberattacks, giving less investigation time over suspicious activity and revoke unauthorised access. Microsoft advised organisations to investigate suspicious app sign-ins, review unexpected changes credentials and privileges, and follow ConnectWise's containment guidance.