JP — ITmedia
China-linked attackers automate attacks with AI agents, implicated in ConnectWise supply chain attack, Microsoft warns
Security2 min read
Microsoft says a China-linked hacking group called Storm-0940 is using AI agents to automate attacks on hundreds of organizations around the world. The group is also linked to a supply chain attack that went through ConnectWise's cloud backup service.
What happened
On October 21, 2025 (US time), Microsoft said that Storm-0940, a hacking group linked to the Chinese state, is using an AI-agent tool called ARTEX to automate attacks. Microsoft also says this group was behind a supply chain attack on ConnectWise's cloud backup service, which came to light in mid-October. A supply chain attack means hackers sneak in through a trusted partner instead of attacking the target directly.
Key numbers and facts
- Storm-0940 has been active since 2021.
- The group began using ARTEX around September and has hit many industries, including aerospace, defense, cars, banks, government, chips, software, media, and think tanks.
- In some cases, attackers got admin-level access to a company's cloud in less than 3 hours after picking the target.
- Attackers tried to sign in to more than 2,250 customer environments (tenants) at a rate of 2,900 times per minute.
- A related attack on about 20 Japanese companies was reported by GMO Cybersecurity by Ierae, and 8 of them had already reported data leaks in September and October.
Background: what is ARTEX?
ARTEX is an open-source tool used to test how safe computer systems are. Hackers can combine it with any AI model. This lets it scout targets and steal data with little human help. Its menus can be shown in English, Japanese, Korean, Chinese, and Spanish. In October, it was also used in a data theft attack on a South Korean bank.
Why it matters
AI agents work day and night, and they can try many break-in paths at once. This makes attacks much faster. Companies that use ConnectWise's cloud backup apps with Microsoft 365 need to act now. Attackers can get into customer systems without the user signing in, and they may leave backdoors even after the first app problem is fixed. Microsoft also says a sign of break-in does not always mean data was actually viewed or stolen.
What to watch
- Microsoft asks users to keep affected app connections turned off until ConnectWise gives official recovery steps.
- Do not delete the app at first, so investigators can keep the evidence.
- Check sign-in logs and audit logs from October 15 at the latest (October 1 if possible).
- Look for unknown added logins, permission changes, and access to strange emails or files. Remove permissions and update logins if misuse is found.
- Give outside apps only the permissions they really need, and keep watching for new logins or permission changes on powerful apps.
Glossary
- Storm-0940
- A hacking group linked to the Chinese state that has been active since 2021 and steals data.
- ARTEX
- An open-source penetration testing tool (a tool that tests system safety) that can be combined with AI models to automate attacks.
- ConnectWise
- A US company that makes software for managing IT services; its Cloud Backup service was used in this supply chain attack.
- Microsoft 365
- Microsoft's online office and cloud service that many businesses use for email, files, and apps.