AI
Microsoft says China-linked hackers used agentic AI against more than 100 organisations
Microsoft says the China-linked Storm-0940 group used the ARTEX AI framework in a campaign targeting more than 100 organisations. The reported activity combined supply-chain compromise, OAuth abuse and password spraying, with some access attempts succeeding in under three hours. Microsoft said 327 accounts across eight organisations were affected, although most targeting was unsuccessful. The company recommends disabling affected ConnectWise connections and reviewing Microsoft 365 and Entra audit records for unauthorised changes. The attribution and campaign details remain Microsoft’s account.
Editorial summary · Publisher article
What matters
- ARTEX reportedly made 2,900 sign-in attempts per minute and affected 327 accounts across eight organisations.
- The campaign targeted sectors including aerospace, defence, energy, government, media, semiconductors and technology.
- Microsoft said the actor abused ConnectWise-related access, OAuth credentials and password spraying.
- Recommended checks include app credentials, privilege changes, unusual sign-ins and altered configurations.
Context & caveats
- The account and attribution come primarily from Microsoft; most reported attempts were unsuccessful.
Why this made the edition
Substantive cybersecurity reporting with detailed attack methods, affected scale, attribution caveats and mitigation steps. Microsoft is the primary source for the central claims, and most attempts reportedly failed.
Source material