Microsoft says a hacking group it links to China used an open-source AI tool to run a supply-chain attack at machine speed, reaching more than 2,250 customer tenants (a tenant is one organization’s Microsoft 365 environment). The finding, published by Microsoft Threat Intelligence on its security blog on 21 October, is one of the clearest vendor accounts yet of a state-aligned group handing the routine steps of an intrusion to software.
The group is Storm-0940. Microsoft describes it as China-state aligned, active since 2021, and focused on stealing data. The China attribution is Microsoft’s own assessment, and so is the claim that the group was behind the ConnectWise compromise disclosed days earlier. The post does not cite a second party for either judgment.
The tool is ARTEX, an open-source framework that can drive any AI model. It is “agentic,” which means AI software that carries out the attack steps by itself instead of waiting for a person to type each command. Microsoft says ARTEX’s agents carry out a full simulated break-in on their own, from scouting the target to stealing data, and record the assets and weaknesses they find in a graph as they go. Penetration testing is normally a defender’s exercise. Here it was turned around.
The timeline runs like this. On 16 October, ConnectWise said customer tenants had been entered without authorization through several OAuth application identities. OAuth apps are the permission slips that let a third-party product into your Microsoft 365 account. Microsoft says Storm-0940 then pointed ARTEX at more than 2,250 tenants, firing off 2,900 sign-in attempts every minute.
Speed is the center of Microsoft’s argument. In multiple cases, the time from first targeting to privileged access in a victim’s cloud was under three hours. Microsoft notes that agents work nights, weekends, and holidays, and can try several routes in at once. The attack traffic is loud and does trigger alerts, but Microsoft says the pace leaves defenders little time to respond in a coordinated way.
The method relied on trust that already existed. With the stolen credentials of ConnectWise’s cloud applications, the agents signed in as those apps, which meant no interactive user login was needed. In some tenants they went on to use Microsoft Graph to scout the directory, change application credentials, and attempt to alter privileges. Microsoft warns that those credential changes can survive as a backdoor even after the original compromised app is cleaned up.
Two limits are worth stating. Microsoft says most of the targeting did not succeed, and an earlier password-spray run between 10 and 14 October, aimed at 327 accounts across eight organizations, produced no successful authentication. It also says an affected app or a successful sign-in does not by itself show that customer data was accessed. The post does not say how many of the 2,250-plus tenants were actually breached, only that privileged persistence was achieved at “many” organizations.
On its own exposure, Microsoft is direct: the activity “did not result from a compromise of or a vulnerability in Microsoft corporate systems, products, or services.” The weak point was a third-party app with broad permissions, which is a problem Microsoft’s customers own as much as the vendor does.
For policy and security teams, the number to hold onto is three hours. A review process that audits third-party app permissions quarterly, or a triage queue that clears alerts the next business day, was designed for human attackers, and Microsoft’s own data says that assumption has now broken.
Reported by Microsoft Threat Intelligence on the Microsoft Security blog, 21 October 2026.
