Microsoft Attributes Major Supply-Chain Cyberattacks to Chinese State-Aligned Group Using AI Tool

Microsoft reported that a China-state-aligned hacking group it tracks as Storm-0940 used an open-source AI-driven penetration-testing framework called ARTEX to conduct automated attacks against hundreds of organizations worldwide, including a supply-chain compromise of ConnectWise’s cloud-backup service.

The activity began as early as September 2026. In the ConnectWise incident, the group attempted sign-ins to more than 2,250 Microsoft 365 tenants at roughly 2,900 attempts per minute. Microsoft observed more than 151,000 failed logon events in one multi-day window and noted that privileged cloud access was achieved in under three hours in multiple cases. Targets included aerospace, defense, energy, financial services, government, manufacturing, semiconductors, and technology firms.

ConnectWise CEO Manny Rivelo stated that, based on Microsoft’s analysis and available evidence, “it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup.” The company said it contained affected application connections and is restoring services in phases, while noting that any unauthorized access already established in customer tenants requires separate review.

Microsoft described ARTEX as an agentic tool that automates reconnaissance, credential attacks, and other steps at machine speed, allowing operations around the clock. The group combined broad password spraying with high-volume authentication attempts. Chinese embassy statements denied conducting or condoning hacking and rejected what it called smears under the pretext of cybersecurity.

The campaign illustrates the speed and scale of AI-enabled operations against software supply chains that can affect many downstream organizations from a single compromise. Microsoft and security researchers have highlighted the reduced time for detection and response when attackers operate at thousands of attempts per minute.