{"id":11070,"date":"2026-10-22T23:10:57","date_gmt":"2026-10-23T03:10:57","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=11070"},"modified":"2026-10-22T22:11:05","modified_gmt":"2026-10-23T02:11:05","slug":"ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/","title":{"rendered":"AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours"},"content":{"rendered":"<p dir=\"ltr\"><a href=\"https:\/\/www.microsoft.com\/en-us\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Microsoft<\/a> says a China-aligned group tracked as Storm-0940 used AI agents and stolen <a href=\"https:\/\/hostingdiscussion.com\/news\/connectwise-suspends-cloud-backup-after-microsoft-365-supply-chain-attack\/\">ConnectWise<\/a> application credentials to go after more than 2,250 Microsoft 365 tenants. The attackers relied on ARTEX, an open source penetration-testing tool that uses AI agents to automate their work. In some cases, they moved from choosing a target to holding privileged cloud access in under three hours.<\/p>\n<p dir=\"ltr\">The findings explain more about the ConnectWise incident. The <a href=\"https:\/\/www.connectwise.com\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">IT management vendor<\/a> shut down its Cloud Backup, SaaS Security and Cloud Management services after it found unauthorized access to application identities. At first, ConnectWise did not name a culprit, but Microsoft has now pointed to Storm-0940, an espionage group active since at least 2021.<\/p>\n<p dir=\"ltr\">ARTEX, written in Go, automates reconnaissance, vulnerability discovery, credential attacks and data theft. Microsoft says Storm-0940 began using it as early as September against organizations worldwide, including government agencies, defense contractors, banks, manufacturers and tech firms.<\/p>\n<p dir=\"ltr\">The campaign started with brute force. Between October 10 and 14, the attackers made more than 151,000 failed sign-in attempts against 327 accounts at eight organizations, and Microsoft saw no successful logins. They then switched tactics and used the compromised ConnectWise application identities. Those credentials let them exploit permissions that customers had already granted, so no interactive login was needed. Armed with ARTEX, they tried to authenticate against more than 2,250 tenants, sometimes reaching 2,900 attempts a minute.<\/p>\n<p dir=\"ltr\"><a href=\"https:\/\/hostingdiscussion.com\/news\/microsoft-365-outage-hits-europe-as-office-2021-support-ends\/\">Microsoft<\/a> also saw AI-accelerated activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to alter privileges. Those steps could let attackers stay put even after defenders revoke the original credentials. Most attempts failed, yet Microsoft says the group still gained persistent privileged access at numerous organizations. It has not said how many customers it compromised or whether anyone stole data, and it cautions that a successful login does not prove access to information.<\/p>\n<p dir=\"ltr\">ConnectWise chief executive Manny Rivelo said the company contained the affected connections and is restoring services gradually. Even so, cutting those connections would not necessarily remove attackers who had already established a foothold. ConnectWise also disclosed a nation-state breach in May 2025, though nothing suggests the two incidents are linked. Other attackers across several regions have also used ARTEX.<\/p>\n<p dir=\"ltr\">The techniques themselves are familiar: stolen credentials, password spraying and application abuse. What changed is speed, since AI helped the attackers move faster through each step.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft says a China-aligned group tracked as Storm-0940 used AI agents and stolen ConnectWise application credentials to go after more than 2,250 Microsoft 365 tenants. The attackers relied on ARTEX, an open source penetration-testing tool that uses AI agents to automate their work. In some cases, they moved from choosing a target to holding privileged [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[8529,8528,1785,8527,2772,8526],"class_list":["post-11070","post","type-post","status-publish","format-standard","hentry","category-uncategorized","tag-ai-powered-cyberattacks","tag-artex-ai-tool","tag-cloud-security","tag-connectwise-breach","tag-microsoft-365","tag-storm-0940"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"Microsoft says a China-aligned group tracked as Storm-0940 used AI agents and stolen ConnectWise application credentials to go after more than 2,250 Microsoft 365 tenants. The attackers relied on ARTEX, an open source penetration-testing tool that uses AI agents to automate their work. In some cases, they moved from choosing a target to holding privileged [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-23T03:10:57+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-10-23T02:11:05+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/\",\"name\":\"AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-10-23T03:10:57+00:00\",\"dateModified\":\"2026-10-23T02:11:05+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/","og_locale":"en_US","og_type":"article","og_title":"AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours - Web Hosting News","og_description":"Microsoft says a China-aligned group tracked as Storm-0940 used AI agents and stolen ConnectWise application credentials to go after more than 2,250 Microsoft 365 tenants. The attackers relied on ARTEX, an open source penetration-testing tool that uses AI agents to automate their work. In some cases, they moved from choosing a target to holding privileged [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/","og_site_name":"Web Hosting News","article_published_time":"2026-10-23T03:10:57+00:00","article_modified_time":"2026-10-23T02:11:05+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/","url":"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/","name":"AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-10-23T03:10:57+00:00","dateModified":"2026-10-23T02:11:05+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/ai-tool-helped-china-linked-hackers-reach-microsoft-365-admin-access-in-three-hours\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"AI tool helped China-linked hackers reach Microsoft 365 admin access in three hours"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":18,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11070","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=11070"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11070\/revisions"}],"predecessor-version":[{"id":11071,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/11070\/revisions\/11071"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=11070"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=11070"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=11070"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}