Microsoft warns that China-linked hackers used AI to speed up cyberattacks: Here's how to stay safe

Microsoft has warned that a China-aligned hacking group used artificial intelligence to speed up cyberattacks against organisations worldwide, automating tasks that would traditionally require significant human effort.

The technology company identified the group as Storm-0940, which allegedly used an AI-powered security testing framework called ARTEX to target cloud systems. Following a supply-chain compromise linked to IT services provider ConnectWise, the attackers attempted to access more than 2,250 customer environments, with activity reaching around 2,900 sign-in attempts per minute, Microsoft reported.

However, Microsoft said most attempts were unsuccessful. It also cautioned that suspicious sign-in activity does not automatically mean customer data was stolen.

How Did Hackers Use AI To Accelerate Attacks?

According to Microsoft, Storm-0940 used ARTEX to automate activities such as scanning systems, identifying potential targets and testing passwords. The group allegedly used the framework to abuse applications that already had permission to access target environments. This allowed attackers to attempt authentication without requiring an interactive sign-in by a user.

Microsoft said the approach accelerated access attempts against Microsoft 365 customer environments. In some cases, attackers reportedly obtained privileged cloud access in less than three hours. The findings highlight how AI-powered tools can increase the speed and scale of cyberattacks. They do not, however, mean that every targeted organisation was successfully compromised.

What Is ARTEX And Why Is It A Concern?

ARTEX is described as an open-source framework that uses AI models to automate security testing. Such tools can help legitimate security teams identify weaknesses and test defences. The same capabilities can also be misused. AI agents can perform multiple tasks simultaneously, allowing attackers to scan systems and test access methods across many targets in less time.

Microsoft said Storm-0940 used ARTEX to accelerate its operations. The company linked the campaign to a supply-chain compromise involving ConnectWise, whose IT management and cloud backup services are used by organisations.

A supply-chain incident can have a wider impact because a compromise involving a service provider may expose multiple customer environments to risk.

What Should Organisations Do To Stay Safe?

Microsoft has advised organisations to review cloud accounts for suspicious sign-ins and unexpected changes to application credentials or access permissions.

Security teams should also examine application access, investigate unusual authentication activity and remove unnecessary permissions. Organisations should ensure that compromised credentials are revoked and that affected systems are investigated before being considered secure. The key concern is not simply that hackers are using AI. It is that automation can help them move faster, target more organisations and exploit existing access before defenders can respond.