On Wednesday, October 21st, Microsoft released a report naming the hacker group “Storm-0940” with ties to the Chinese Communist Party for using the AI penetration tool ARTEX to successfully breach the IT service company ConnectWise and gain cloud high-level permissions in hundreds of organizations worldwide. Some attacks, from targeting to obtaining privileged access, took less than 3 hours.
According to Microsoft Security Research, Storm-0940, active since 2021 with ties to the Chinese government, has been using the AI penetration tool ARTEX developed in China to launch automated attacks on hundreds of organizations across various industries worldwide since September.
ARTEX, described by Microsoft as a tool with autonomous agent capabilities, allows hackers to conduct network reconnaissance, password spraying (brute force password testing), and sensitive data leakage phases almost without the need for manual intervention.
This attack impacted various sectors globally, including aerospace, defense, automotive, chemical, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks, and non-profit organizations, affecting over 2,250 Microsoft cloud tenants.
Storm-0940 used ARTEX from October 10th to 14th to target 8 organizations’ 327 accounts for password spraying attacks, leading to over 150,000 failed login attempts and a peak rate of 2,900 attempts per minute, aiming to overwhelm defense systems.
Subsequently, on October 15th-16th, the group successfully breached ConnectWise’s cloud backup environment using vulnerabilities, attempted to log into over 2,250 tenants in the same manner, and implanted “privileged persistence” backdoors in some affected organizations’ cloud directories via OAuth applications.
Microsoft noted that some attacks took less than 3 hours from initial targeting to obtaining privileged access. ConnectWise publicly acknowledged the breach on October 16th and promptly shut down the system.
ConnectWise CEO Manny Rivelo stated that, based on Microsoft’s analysis and evidence held by the company, Storm-0940 with ties to the Chinese Communist Party initiated the attack on their cloud. System recovery is currently underway, and repairs are expected to take several days to complete.
Rivelo mentioned that “these actions do not clear potential unauthorized accesses established in individual customer tenants, these issues require further investigation,” advising customers to temporarily maintain suspended connections.
ARTEX, a Chinese-developed open-source penetration testing framework released in July this year, can execute automated attack processes with any AI model. On October 8th, due to reports of abuse, the tool was converted to closed-source.
Before the attack on ConnectWise by Storm-0940, ARTEX had been used in attacks on organizations in Japan and South Korea. Security company CrowdStrike reported that hackers used ARTEX to target financial institutions like New Korean Bank and KB Kookmin Bank in Korea, leading to the leak of around 68,000 people’s data.
Daiki Fukumori, Director of the GMO Internet Group’s Cybercrime Response Center, stated on October 19th that server infrastructure targeting Japanese companies also utilized ARTEX in attacks across e-commerce, finance, retail, logistics, media, education, and marketing sectors.
The attacks affected approximately 80 companies, with at least 8 confirming data breaches, including Daiwa Securities, East Japan Railway (JR East), and SoftBank.
The center mentioned that in late September to early October 2026, attacks against Korean financial institutions also employed ARTEX, hinting that Japanese companies may be facing similar attack methods.
Public reports have not directly attributed the attacks in Japan and Korea to Storm-0940, but they suggest the involvement of Chinese hackers or the use of Chinese-developed tools and Chinese language interfaces.
The Chinese Embassy in Washington has not responded to Microsoft’s report. While China has denied involvement in any form of hacking in the past, tech companies like Microsoft and multiple cybersecurity institutions assess that actions by multiple hacker groups, including Storm-0940, are linked to Chinese direction.