China-Linked Hacker Used Agentic AI to Reach Cloud Privileges in Under 3 Hours, Microsoft Says

A China-state-aligned threat actor, Storm-0940, used an agentic AI penetration-testing framework to automate cyberattacks against hundreds of organizations worldwide, with several attacks reaching privileged cloud access in less than three hours, according to Microsoft.

The campaign also involved the recently disclosed ConnectWise supply-chain compromise, showing how AI can transform established hacking techniques into machine-speed attacks.

AI Turns Cyberattacks Into a Race Against Time

Microsoft said Storm-0940 began using the open-source ARTEX framework as early as September 2026 to automate attacks across industries including aerospace and defense, automotive, energy, financial services, government, manufacturing, technology and semiconductors.

This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially.

ARTEX is a multi-agent large language model system designed to automate penetration testing from reconnaissance through data exfiltration with limited human interaction.

Microsoft said its agents can simultaneously pursue multiple breach paths, allowing attackers to operate continuously rather than at the pace of human operators.

“Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives,” Microsoft said.

Storm-0940 historically relied on techniques including password spraying and exploitation of internet-facing applications. With ARTEX, Microsoft observed automated scanning and reconnaissance, password spraying and abuse of OAuth applications during the ConnectWise incident.

ConnectWise Attack Shows the Scale of AI-Driven Abuse

The scale of the activity became particularly striking after Storm-0940 obtained control of identities associated with multiple ConnectWise cloud applications.

The AI agents then used stolen application credentials to authenticate into customer environments, taking advantage of the trust already granted to those applications.

ConnectWise said the actor attempted to sign in to more than 2,250 tenants at a rate of 2,900 sign-in attempts per minute. In a separate password-spraying campaign between Oct. 10 and 14, Microsoft recorded more than 151,000 failed logon events targeting 327 accounts across eight organizations.

While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.

In affected environments, Microsoft observed activity through Microsoft Graph including reconnaissance, application credential changes and attempts to modify privileges. Such changes could allow attackers to establish persistence through other identities, credentials and cloud services.

Microsoft Warns Speed Could Outrun Defenders

The danger, Microsoft said, is not simply that AI makes attacks more automated. It can compress the time defenders have to detect, investigate and contain them.

When automated with AI, these activities generate a large volume of traffic and log data that may generate alerts. However, the speed of the activity allows very little time for Defenders to respond to those alerts and remediate the actor’s access in a coordinated fashion.

Microsoft stressed that the presence of an affected application or successful authentication does not necessarily mean customer data was accessed or exfiltrated.

It also said the ARTEX activity did not result from a compromise of or vulnerability in Microsoft’s corporate systems, products or services.

The company recommends organizations review service-principal sign-ins, application credential and privilege changes, Microsoft Graph activity and unusual mail or file access.

It also advises applying least privilege to multi-tenant applications, monitoring anomalous app-only activity and preserving evidence before removing unauthorized credentials or permissions.