China used AI agents to hack 2,250 companies. It took hours

A China-state-aligned hacking group has become the first confirmed nation-state actor to weaponize commercially available AI agent tools in a live supply-chain attack — and the results should terrify every organization that relies on multi-factor authentication as a last line of defense.

Microsoft disclosed on October 21, 2026 (UTC) that the group it tracks as Storm-0940 used an open-source agentic AI penetration-testing framework called ARTEX to automate attacks against more than 2,250 Microsoft 365 tenants at a rate of 2,900 sign-in attempts per minute. In multiple victim organizations, the time from initial targeting to privileged cloud access was under three hours.

This isn't a proof-of-concept or a lab experiment. It's a confirmed, active campaign by a nation-state actor using AI agents to scale intrusion operations at machine speed.

How the attack unfolded

The timeline reads like a playbook for AI-accelerated cyber warfare:

• September 2026: Storm-0940 begins using ARTEX to automate reconnaissance, password spraying, and OAuth application abuse against hundreds of organizations globally.
• October 10–14, 2026 (UTC): Infrastructure at IP 144.172.64.99 conducts an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations. Microsoft telemetry captures 151,000+ failed logon events, peaking at 2,900 failures per minute on October 11. More than 111,000 failures concentrate in a single day. Forty-eight accounts receive over 1,000 failed attempts each. Lockout responses represent nearly 98% of all activity. No successful authentication is observed during this phase.
• October 15, 2026 (UTC): The AI agents acquire control of multiple ConnectWise Cloud Backup application identities. Using these stolen OAuth credentials, they authenticate directly to customer Microsoft 365 environments through applications that had already been granted access — no interactive user sign-in required.
• October 16, 2026 (UTC): ConnectWise publicly reports unauthorized access to customer tenants.
• Post-October 15: ARTEX-driven agents attempt sign-ins to more than 2,250 tenants at 2,900 attempts per minute. In multiple environments, agents progress beyond authentication to Microsoft Graph operations: reconnaissance, application credential modifications to establish persistence, and changes to identities, groups, and privileged roles.

The critical insight is that MFA was never defeated — it was bypassed entirely. By compromising ConnectWise's OAuth application identities, Storm-0940 obtained credentials that applications use to authenticate non-interactively. These app-level authentications don't trigger MFA prompts because there's no human user in the loop. Every victim organization that had granted ConnectWise Cloud Backup access to their tenant was potentially exposed, regardless of how rigorously they enforced MFA for human users.

What is ARTEX?

ARTEX is an open-source penetration-testing framework built as a multi-agent LLM system in Go with a Next.js frontend. It can plug in virtually any AI model — DeepSeek, GLM, Grok, Claude, GPT — and autonomously run a full penetration test from reconnaissance through data exfiltration with minimal human intervention. Agents accumulate discovered assets and vulnerabilities into a graph as they work.

Security researchers at Zscaler who examined a custom ARTEX deployment found it configured to use a DeepSeek model through an OpenAI-compatible gateway, with alternate configurations specifying DeepSeek, GLM, and Grok. Prompt histories revealed instructions for models to divide investigation tasks and review one another's findings — GLM was directed to audit work performed by DeepSeek and its subagents. The prompts included requests for bulk personal and transaction data, questions about selling stolen data, and instructions for extracting payment gateway API keys, suggesting the attacks were at least partly financially motivated.

ARTEX was made closed-source in October 2026 after public reporting linked it to attacks on South Korean financial institutions. Recorded Future's Insikt Group tracks a related cluster as TAG-217, whose activity dates back to August 17, 2026, when it tested infrastructure for remote access and conducted internet scanning. That group later targeted cryptocurrency mining operations and set up workspaces for testing iPhone and Android vulnerabilities.

Who got hit

The target list reads like a cross-section of the global economy: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, and think tanks. Microsoft emphasized that while most targeting attempts failed, Storm-0940 achieved privileged cloud persistence at many organizations in a brief window.

ConnectWise, which temporarily shut down its Cloud Backup service after the compromise, has been restoring service in phases — a process the company says will take several days. The affected application IDs include ConnectWise Cloud Backup, ConnectWise MS Teams integration, ConnectWise MS Graph integration, and the SkyKick Partner Portal.

Microsoft was careful to state that the activity did not result from a compromise of its own systems, products, or services. The vulnerability was in ConnectWise's multi-tenant application, which Storm-0940 abused as a pivot point into downstream customers.

Why this changes everything

The significance of this campaign goes far beyond a single supply-chain compromise. It marks the moment when AI agents graduated from a red-team curiosity to a confirmed nation-state weapon — and the implications are uncomfortable for an industry that has spent the past two years selling AI agents as a productivity revolution.

The speed problem is real. Three hours from targeting to privileged access is not a typo. A human attacker might spend days or weeks on reconnaissance, credential testing, and lateral movement. An AI agent running 2,900 sign-in attempts per minute doesn't sleep, doesn't take weekends, and doesn't need to rotate shifts. Microsoft's own language is stark: "Agents are not constrained by factors affecting humans — they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously."

The 151,000 failed logons in the password-spray phase are instructive. At 2,900 attempts per minute, that volume takes less than an hour. A human team would need days to generate the same traffic, and defenders would have far more time to detect and respond. With AI, the defender's window shrinks from days to minutes.

MFA is not enough. This campaign exploited a structural blind spot in how organizations think about identity security. Most companies enforce MFA rigorously for user sign-ins but pay far less attention to the OAuth applications they've granted access to their tenants. A compromised third-party application with pre-authorized scopes is a skeleton key that doesn't need to pass through MFA at all. The industry has known about OAuth abuse for years, but AI agents make it operationally feasible to abuse thousands of app identities simultaneously at machine speed.

The open-source dilemma sharpens. ARTEX was freely available on GitHub before being closed-sourced. Its creator, a Chinese security engineer, built it as a legitimate penetration-testing tool. The same democratization that makes AI accessible to defenders also puts autonomous attack frameworks in the hands of anyone with an API key. The South Korean financial attacks linked to ARTEX reportedly cost as little as $0.88 per compromised bank perimeter system — a price point that makes large-scale cyber operations affordable for actors who couldn't previously afford them.

The target selection tells a story. Aerospace, defense, semiconductors, military, government — these are classic Chinese intelligence priorities. The financial motivation suggested by the ARTEX prompts (selling stolen data, payment gateway keys) adds a second layer: this isn't purely espionage. It's a hybrid campaign that combines state intelligence collection with financially motivated data theft, all automated by AI agents.

The numbers, interpreted

The 98% lockout rate is a double-edged number. On one hand, it shows that basic defenses caught the password-spray phase. On the other hand, account lockout is a passive defense that does nothing against the OAuth abuse phase — and it creates its own denial-of-service problem when 48 accounts each receive 1,000+ failed attempts. The attackers didn't need the password spray to succeed; it was likely a diversion or a broad sweep while the real attack vector — the ConnectWise application compromise — was prepared separately.

The $0.88 figure from the South Korean attacks deserves attention. If a nation-state can compromise a bank's perimeter for less than the cost of a cup of coffee, the economics of cyber defense are fundamentally broken. Defenders spend millions on SOCs, SIEMs, and threat intelligence; attackers spend pocket change on AI API tokens.

What comes next

This campaign is not an isolated incident. Microsoft explicitly states it has observed threat actors across multiple geographic regions weaponizing ARTEX. The framework's closure doesn't eliminate the risk — the code was public long enough to be forked and adapted, and competing frameworks will fill the gap.

Three developments are worth watching closely:

1. Will other nation-state groups adopt AI agent frameworks? Storm-0940 is the first confirmed case, but Russia's APT29, North Korea's Lazarus Group, and Iran's Charming Kitten have all shown interest in automation. The barrier to entry is now a GitHub clone and an API key.

2. Will Microsoft and other identity providers change how OAuth app access works? The non-interactive authentication model that allowed this attack is fundamental to how SaaS integrations function. Requiring step-up authentication for high-privilege app operations, or implementing continuous access evaluation for service principals, would be significant architectural changes.

3. Will ConnectWise customers discover data exfiltration? Microsoft says successful authentication doesn't necessarily mean data was accessed. But the agents were observed performing Microsoft Graph reconnaissance and modifying application credentials — behaviors consistent with preparing for data extraction. The full impact may not be known for weeks as organizations conduct forensic reviews.

The most sobering takeaway is that this is what the beginning of AI-accelerated cyber conflict looks like. Not Skynet. Not a rogue AI. Just a determined nation-state actor, an open-source framework, and a few API keys — compressing what used to take a team of humans weeks into an automated process that runs at 48 authentication attempts per second, around the clock, until someone notices.

By the time someone notices, the agents are already three hours deep.

Sources: Microsoft Security Blog (October 21, 2026), The Hacker News (October 22, 2026), Tech Times (October 22, 2026), Infobae (October 22, 2026), AI Tech Daily (October 22, 2026), Daily Security Review (October 22, 2026), Zscaler ThreatLabz, Recorded Future Insikt Group.