{"slug": "microsoft-warns-that-china-linked-hackers-unleash-ai-powered-cyberattacks-on-us", "title": "Microsoft Warns That China-Linked Hackers Unleash AI-Powered Cyberattacks on US Supply Chains", "summary": "Microsoft reported on 21 October that the China-aligned hacking group Storm-0940 used an AI-powered penetration testing framework called ARTEX to automate attacks on hundreds of organisations worldwide as early as September 2026, and assessed the group was responsible for a supply chain compromise involving a multi-tenant application tied to ConnectWise Cloud Backup. Microsoft said ARTEX automated reconnaissance, password spraying and OAuth application abuse, with compromised application credentials used to attempt access to downstream customers' Microsoft 365 environments; most targeting attempts were unsuccessful. A separate automated password-spraying campaign between 10 and 14 October 2026 targeted 327 accounts across eight organisations and produced more than 151,000 failed logon events, peaking at 2,900 failures per minute on 11 October, with no successful authentication recorded.", "body_md": "# Microsoft Warns That China-Linked Hackers Unleash AI-Powered Cyberattacks on US Supply Chains\n\n## The campaign targeted hundreds of organisations through compromised credentials to access Microsoft 365 and cloud infrastructure\n\nMicrosoft reported on 21 October that [China-aligned hacking group](https://www.ibtimes.co.uk/us-army-warns-bases-infrastructure-disrupt-deployments-1826114) Storm-0940 used an [AI-powered penetration testing framework](https://www.ibtimes.co.uk/its-not-script-kiddie-stuff-hacker-reportedly-uses-ai-breach-corporate-sites-just-50-1826483) to automate attacks against organisations worldwide as early as September 2026. The company also assessed that Storm-0940 was responsible for a supply chain compromise involving a multi-tenant application associated with ConnectWise Cloud Backup.\n\nThe findings highlight the risks of interconnected business systems, where compromised [third-party application access](https://www.ibtimes.co.uk/us-banks-restrict-third-party-ai-agents-1827385) can expose customer environments. Microsoft said the campaign targeted hundreds of organisations across multiple industries, although most targeting attempts were unsuccessful.\n\n## How AI-Powered Cyberattacks Abused ConnectWise Application Access\n\nConnectWise said it identified unauthorised access to application credentials linked to Cloud Backup, formerly known as SkyKick. Microsoft said Storm-0940 subsequently used compromised application credentials to attempt access to downstream customers' Microsoft 365 environments.\n\nMicrosoft identified ARTEX as an open-source penetration testing framework that uses artificial intelligence agents to automate offensive security workflows. The company said Storm-0940 used the framework to accelerate attacks against downstream organisations.\n\nAccording to Microsoft's security investigation, ARTEX helped automate reconnaissance, password spraying and OAuth application abuse. Compromised application identities allowed attackers to attempt authentication through applications already granted access to Microsoft 365 environments, without requiring an interactive user sign-in.\n\nMicrosoft described the wider implications in its report. 'This activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows and allows them to scale their operations exponentially,' the company stated.\n\nMicrosoft said [AI agents could operate around the clock](https://www.ibtimes.co.uk/openai-anthropic-ai-safety-incidents-1822208) and attempt multiple breach paths simultaneously. That automation can reduce the time defenders have to detect suspicious activity and revoke unauthorised access.\n\nThe ConnectWise incident demonstrates how compromised third-party application identities can expose customer environments through permissions already granted to those applications. The risk can extend beyond the original service provider, particularly when applications have extensive access to cloud systems.\n\nIn an update on 25 October, ConnectWise said restoration, testing and security validation were continuing. The company expected to begin phased partner onboarding on 26 October, subject to successful testing, with backup restoration access planned before full service re-enrolment.\n\n## Microsoft Details the Scale of AI-Powered Cyberattacks\n\nMicrosoft's report also documented an [automated password-spraying campaign](https://www.ibtimes.co.uk/denmark-cpr-register-breach-123456-password-allegation-1825893) between 10 and 14 October 2026. The activity targeted 327 accounts across eight organisations in an attempt to access Microsoft 365 and Exchange Online.\n\nMicrosoft recorded more than 151,000 failed logon events during the campaign. Activity peaked on 11 October, reaching 2,900 failures per minute. Despite that volume, the company observed no successful authentication, token issuance, Microsoft Graph calls or directory changes resulting from this particular password-spraying activity.\n\nMicrosoft distinguished the unsuccessful password-spraying campaign from the subsequent abuse of compromised ConnectWise application credentials. The activities were linked by indicators identified during the investigation, but the password-spraying campaign itself produced no observed successful authentication.\n\nIn the wider campaign, Microsoft assessed that Storm-0940 obtained privileged access to cloud infrastructure at multiple organisations. Some intrusions reached that level in less than three hours after initial targeting.\n\nMicrosoft reported more than 2,250 attempted tenant sign-ins associated with the campaign. The figure represents attempted access, not confirmation that every tenant was compromised.\n\nIn multiple affected environments, Microsoft observed follow-on activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to modify privileges. It warned that unauthorised credentials or other changes could preserve access even after the original compromised application was disabled.\n\nHowever, Microsoft cautioned that an affected application or evidence of successful authentication does not necessarily establish that customer data was accessed or extracted. Attempted access, successful authentication, privileged access and confirmed data theft are separate outcomes.\n\n## What Microsoft's Warning Means for Businesses\n\nMicrosoft said the campaign targeted organisations across aerospace, defence, automotive, energy, [financial services](https://www.ibtimes.co.uk/regulators-ramp-scrutiny-banks-fearing-ai-could-lock-customers-out-their-accounts-1825309), government, manufacturing, technology and other sectors. The breadth of the targeting illustrates how third-party application access can create [security risks](https://www.ibtimes.co.uk/critical-php-flaws-exploited-php2shell-emergency-patches-1827215) across industries.\n\nThe company also said the activity did not result from a compromise of, or vulnerability in, its own corporate systems, products or services. Its findings instead centred on the misuse of third-party application access and subsequent activity within customer environments.\n\nMicrosoft recommended that organisations review application sign-ins, audit records and unexpected changes to credentials or privileged roles. It also advised customers to preserve evidence and follow ConnectWise's containment guidance.\n\nMicrosoft warned that disabling a compromised application does not necessarily reverse changes made within a customer tenant. Organisations should therefore review credentials, permissions and other access changes as part of their investigations.\n\nConnectWise's 25 October update said restoration and security validation remained ongoing, with phased partner onboarding targeted for 26 October, subject to successful testing. The planned date did not confirm that restoration or onboarding had been completed.\n\n© Copyright IBTimes 2026. All rights reserved.", "url": "https://wpnews.pro/news/microsoft-warns-that-china-linked-hackers-unleash-ai-powered-cyberattacks-on-us", "canonical_source": "https://www.ibtimes.co.uk/microsoft-storm-0940-ai-attacks-connectwise-cloud-backup-1827903", "published_at": "2026-10-26 14:35:46+00:00", "updated_at": "2026-10-26 14:44:51.964652+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "ai-agents"], "entities": ["Microsoft", "Storm-0940", "ConnectWise", "ConnectWise Cloud Backup", "SkyKick", "ARTEX", "Microsoft 365", "Exchange Online"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/microsoft-warns-that-china-linked-hackers-unleash-ai-powered-cyberattacks-on-us", "markdown": "https://wpnews.pro/news/microsoft-warns-that-china-linked-hackers-unleash-ai-powered-cyberattacks-on-us.md", "text": "https://wpnews.pro/news/microsoft-warns-that-china-linked-hackers-unleash-ai-powered-cyberattacks-on-us.txt", "jsonld": "https://wpnews.pro/news/microsoft-warns-that-china-linked-hackers-unleash-ai-powered-cyberattacks-on-us.jsonld"}}