Chinese hackers used AI to break into thousands of businesses

A sophisticated cyberattack has exposed a new level of speed in digital threats. Hackers used artificial intelligence to break into a widely used business management platform. They then used that access to probe thousands of other companies. The entire operation moved faster than most security teams can react.

Microsoft has linked the attack to a group known as Storm-0940. This actor is aligned with the Chinese state. The group relied on an open-source framework called ARTEX. This tool uses AI agents to perform penetration testing on its own. It automates the process of scanning for weaknesses and trying to log in to systems.

The attackers used stolen credentials from ConnectWise applications. This allowed them to sign in as the software itself. They did not need a human user to type in a password. They attempted to sign in to more than 2,250 Microsoft 365 tenants. In some cases, they reached high-level access in less than three hours.

The use of AI agents changed the pace of the intrusion. These digital workers can run around the clock. They require little human input. They sped up the process of scanning networks and testing passwords. This left defenders with very little time to spot the activity and respond.

A separate password-spraying effort targeted 327 accounts across eight organizations. This produced over 151,000 failed login attempts. None of these attempts succeeded. At its peak on October 11, the spray reached 2,900 attempts per minute. Almost 98 percent of the activity resulted in account lockouts.

The takeover of ConnectWise cloud apps proved more effective. Using four sets of credentials, the AI agents signed in to customer tenants. They recorded more than 200 sign-ins in under four minutes. Within some tenants, they changed app credentials and adjusted privileged roles. They also performed reconnaissance tasks.

Security firm Huntress observed one tenant on October 15. An app added itself to the Global Administrator role. This action triggered alerts in Microsoft Defender. The attackers planted new secrets set to expire in 2028. By October 16, Huntress confirmed unauthorized sign-ins at 162 tenants. A day later, nearly 1,000 tenants showed activity from the attacking IP address.

The attackers moved through tenants in a sorted order. The sign-ins occurred seconds apart. This pattern suggests a script working from a target list. The use of ARTEX sets this campaign apart. Public reporting this month linked the tool to breaches at South Korean financial institutions. The developer of ARTEX has since stated the project will no longer be updated.

ConnectWise detected the unauthorized access and suspended several services. These include Cloud Backup, SaaS Security, and Cloud Management. The company has begun a phased restoration that may take several days. It reports no current indicators that partner backup data was compromised.

Microsoft cautioned that an affected app does not automatically mean data was taken. It advised customers to keep affected app connections disabled. Users should wait for formal restoration instructions. They should also review activity from this month where logs allow. The incident highlights the need for faster detection in an age of automated threats.