A China-state-aligned hacking group has used artificial intelligence to launch a sweeping cyberattack against hundreds of organizations worldwide, exposing serious vulnerabilities in corporate cloud infrastructure and trusted software supply chains. The group, identified as Storm-0940, employed an autonomous AI framework called ARTEX to accelerate reconnaissance, password attacks, and unauthorized access to Microsoft cloud environments. Investigators documented more than 151,000 failed login attempts during an October campaign, with automated activity reaching approximately 2,900 attempts per minute. After compromising software provider ConnectWise, attackers exploited trusted application credentials to attempt access across more than 2,250 customer cloud environments. Some operations achieved privileged access in less than three hours. The campaign targeted industries critical to American economic and national security, including defense, aerospace, energy, finance, government, and semiconductor manufacturing, underscoring the growing threat posed by foreign adversaries weaponizing AI against American institutions.
Key Takeaways
• AI Is Accelerating Foreign Cyberattacks: China-linked hackers used autonomous AI agents to conduct thousands of authentication attempts per minute, dramatically reducing the time needed to compromise cloud systems.
• Trusted Software Providers Are Vulnerable: The ConnectWise compromise demonstrated how attackers can exploit legitimate third-party application credentials to reach numerous customer organizations through established cloud permissions.
• National Security Risks Are Expanding: Attacks targeting defense, energy, government, financial institutions, and technology companies highlight the urgency of stronger cybersecurity requirements, supply-chain accountability, and rapid threat detection.
In-Depth
A sophisticated cyberespionage campaign attributed to China-state-aligned hackers is demonstrating how artificial intelligence can transform the speed and scale of attacks against American businesses and government institutions. The group, designated Storm-0940, deployed ARTEX, an autonomous penetration-testing framework, to identify vulnerabilities, test credentials, and exploit trusted cloud applications across hundreds of organizations.
The operation represents a significant escalation in cyber capabilities. Between October 10 and 14, investigators observed more than 151,000 unsuccessful login attempts targeting 327 accounts at eight organizations. Although that particular password-spraying campaign produced no successful logins, other operations achieved privileged cloud access in under three hours.
The attackers also compromised application identities associated with ConnectWise, a technology provider serving business customers. By exploiting credentials belonging to previously authorized applications, the hackers attempted to authenticate across more than 2,250 cloud tenants, potentially bypassing defenses that distinguish trusted software from suspicious outsiders.
The implications extend beyond ordinary corporate data theft. Targeted industries included aerospace, defense, energy, financial services, government, manufacturing, and semiconductor technology. Successful compromises in these sectors could expose sensitive commercial information, intellectual property, or strategically important operational systems.
The campaign also illustrates the dangers of excessive privileges granted to outside software providers. Once trusted application credentials are stolen, attackers may establish additional access mechanisms that survive the initial containment effort.
For American policymakers and corporate leadership, the warning is unmistakable. Cybersecurity defenses designed around human-speed attacks are increasingly inadequate against autonomous systems operating continuously. Stronger identity controls, restricted application permissions, aggressive credential monitoring, and faster incident response are becoming essential safeguards. Protecting critical infrastructure and sensitive information will require treating AI-enabled foreign cyber operations as a persistent national security threat rather than an isolated technological problem.