Microsoft says Chinese hackers used AI agents to attack hundreds of organisations worldwide

Artificial intelligence is no longer just for writing emails or creating images. Cybercriminals are now using AI to launch fast and highly destructive cyberattacks. According to a new warning from Microsoft, a hacking group linked to China has used an AI-powered tool to break into hundreds of companies across the globe.
The hacker group, identified by Microsoft as “Storm-0940”, used an artificial intelligence tool to automate their attacks. This gave them deep and high-level control over company cloud networks in less than three hours.
The hackers did not attack the companies directly. Instead, they used a backdoor method known as a supply chain attack. They targeted ConnectWise, a popular IT services company, specifically focusing on its Cloud Backup service.
ConnectWise CEO Manny Rivelo said that a China-aligned group appears to be behind the attack. To stop the damage, ConnectWise paused the affected application connections and is now restoring services slowly. However, Rivelo warned that just stopping the connections does not automatically kick out the hackers if they have already established access inside a customer’s network. Customers will need to review their systems separately.
The Chinese Embassy in Washington has not yet commented on the incident. However, the Chinese government regularly denies any involvement in cyber theft and hacking activities.
To carry out this massive campaign, the hackers used an open-source software called ARTEX. Normally, ARTEX is a legitimate penetration testing framework used by security professionals to find weaknesses in networks. However, Storm-0940 misused its AI capabilities to automate malicious tasks like scanning systems and stealing data.
Microsoft’s report explicitly states that Storm-0940 used the ARTEX AI tool to automate both the initial password spraying campaign and the subsequent OAuth application abuse. The AI was used right from the start to accelerate the password guessing at machine speed; it was not a traditional manual effort before they switched to AI.
They used the AI tool to abuse the trusted digital keys that ConnectWise already used to connect to Microsoft 365 accounts. Because these backup apps were already trusted, the hackers bypassed standard login screens completely.