China-linked Storm-0940 hackers use AI tool ARTEX to launch 2,900 login attempts per minute
Microsoft Threat Intelligence, in a report published on October 21, said the hackers targeted organisations across defence, aerospace, banking, energy, technology, government and several other sectors. The group is linked to a recent security breach involving ConnectWise Cloud Backup, a service used by businesses to protect their data. The case raises fresh concerns about how quickly AI tools can help attackers find and exploit weaknesses in corporate networks.
:
What is ARTEX and how did hackers use it?
ARTEX is an open-source AI framework originally developed for security testing. It allows AI agents to scan computer networks, identify weaknesses, test passwords and perform multiple tasks with limited human involvement.
Storm-0940 reportedly used the tool to speed up attacks against businesses and their cloud accounts. Microsoft said some victims lost control of privileged accounts within hours.
The hackers exploited access granted to ConnectWise applications to enter Microsoft 365 customer environments. This meant they could attempt operations without requiring employees to log in.
:
AI agents attempted 2,900 logins every minute
The scale of the activity is particularly concerning.
Between October 10 and 14, Microsoft’s systems recorded more than 1.51 lakh failed login attempts involving 327 accounts across eight organisations. That password-guessing campaign recorded no successful logins.
After the ConnectWise compromise, attackers attempted to access more than 2,250 Microsoft 365 customer environments.
| Attack activity | Microsoft’s findings |
|---|---|
| Organisations targeted | Hundreds worldwide |
| Accounts targeted in password attacks | 327 |
| Failed login attempts | Over 1.51 lakh |
| Peak login attempt rate | 2,900 per minute |
| Customer environments targeted through ConnectWise | Over 2,250 |
| Fastest reported compromises | Under 3 hours |
Microsoft most attack attempts failed, but hackers managed to establish lasting privileged access at several organisations.
:
Who is Storm-0940?
Storm-0940 is a China-linked hacking group that Microsoft has tracked since 2021. Researchers previously connected it to password attacks, stolen login credentials and attempts to access sensitive corporate information.
The group has historically targeted governments, defence companies, law firms and research organisations.
The latest investigation suggests that AI is helping the group conduct familiar hacking activities much faster.
:
What should organisations do?
Microsoft has advised affected organisations to examine suspicious login activity, review permissions granted to third-party applications and investigate unexpected changes to administrator accounts.
Businesses using ConnectWise Cloud Backup should follow the company’s containment instructions and check whether unauthorised credentials remain active.
Microsoft clarified that the attacks did not result from a security flaw in its own systems. The company further cautioned that successful authentication does not automatically mean attackers accessed or stole customer data.
The bigger concern is the shrinking response time. With AI agents conducting thousands of actions in minutes, security teams may have very little time to stop an intrusion once it begins.