Exploitation of Artificial Intelligence in Cyberattacks
Microsoft reported that the Chinese threat group known as Storm-0940, active since 2021, has begun using the open-source penetration testing framework Artex to automate attack campaigns targeting hundreds of organizations. This shift toward AI-powered automation enabled the attackers to execute reconnaissance operations and password spraying attacks at unprecedented speeds.
Details of the ConnectWise Attack
In mid-October 2026, the group targeted the working environments of ConnectWise customers, prompting the company to suspend critical services such as cloud backup and software-as-a-service (SaaS) security. According to technical observations, the attackers used compromised credentials to access hundreds of Microsoft 365 and Entra tenants.
Data indicates that the attackers successfully executed more than 2,900 login attempts per minute, with over 151,000 failed attempts recorded, followed by successful authentications that exploited ConnectWise cloud application identities.
What is Changing Operationally?
The danger lies in the fact that AI agents did not stop at the authentication process, but proceeded to execute advanced operations within victim environments, including:
- Conducting reconnaissance operations within Microsoft Graph.
- Modifying application credentials to ensure persistence even after the original vulnerabilities are addressed.
- Making changes to high-privilege identities, groups, and roles.
Security Recommendations for Organizations
Microsoft warns organizations of the necessity to thoroughly examine service principal login operations and correlate them with subsequent activities within Microsoft Graph and changes in the Active Directory. Security teams must distinguish between authorized administrative activities and suspicious activities that may indicate the exploitation of automated tools like Artex.
These attacks confirm a growing trend among advanced persistent threat (APT) groups to use artificial intelligence tools to narrow the time gap between vulnerability discovery and breach execution, placing additional pressure on incident response teams.