Microsoft: Storm-0940 Used AI Tool Artex to Attack Hundreds of Organizations
Microsoft says the China-linked group automated attacks worldwide with the open-source tool Artex, sometimes gaining cloud admin rights in under three hours.
Microsoft said a China-linked hacking group tracked as Storm-0940 used AI agents built by Chinese engineers to attack hundreds of organizations worldwide, according to digitaltoday.co.kr. The group automated those attacks with the open-source AI penetration-testing tool Artex, targeting organizations across multiple industries.
Microsoft said the campaign began as early as September. In some cases, Storm-0940 obtained administrator privileges on victims' cloud infrastructure in under three hours.
Microsoft also attributed the recently disclosed ConnectWise data breach to Storm-0940. ConnectWise is a software company whose data was leaked in that incident.
Artex appears in other reported attacks
CrowdStrike said in a report earlier in October 2026 that a hacker who attacked South Korean financial institutions used Artex. Separately, The Information reported on October 21 on another AI-automated attack targeting more than 400 financial institutions in Latin America.
Quick answers
What is Storm-0940?
Storm-0940 is the designation Microsoft uses for a China-linked hacking group that it says used AI agents and the Artex tool to automate attacks on hundreds of organizations.
What is Artex?
Artex is an open-source AI penetration-testing tool that Storm-0940 used to automate attacks, according to Microsoft. CrowdStrike also reported its use in an attack on South Korean financial institutions.
Which breach did Microsoft attribute to Storm-0940?
Microsoft attributed the recently disclosed ConnectWise data breach to Storm-0940.