Microsoft links Storm-0940 to AI-driven attacks using ARTEX framework

Microsoft says a China state-aligned hacking group handed much of its job to an AI system. Based on the results, the system was a fast learner. In a report released October 21, 2026, Microsoft Threat Intelligence tied the threat actor it tracks as Storm-0940 to a sprawling campaign run through ARTEX, an AI-driven penetration-testing framework. In some incidents, the group reportedly moved from a first foothold to elevated cloud privileges in less than three hours. How the campaign worked ARTEX takes the penetration-testing concept and automates it with AI. According to Microsoft’s findings, Storm-0940 used it to run several attack phases on autopilot, including reconnaissance and exploitation, across hundreds of organizations. The research describes one operation that ran from October 10 to 14 and targeted 327 accounts using ARTEX. The campaign then exploited a ConnectWise supply chain compromise that took place October 15-16, 2026, and ConnectWise publicly acknowledged the breach on October 16. Through that opening, attackers abused OAuth application identities. Storm-0940 used those identities to fire off authentication attempts at a rate of 2,900 sign-in attempts per minute. Mic...