Microsoft: China‑linked Cyber Actor Deploys Artificial Intelligence

U.S.-based technology company Microsoft announced that a cyber actor linked to the Chinese state has targeted hundreds of organizations worldwide by leveraging AI‑powered tools. In a blog post released by Microsoft Security Research and Microsoft Threat Intelligence teams, it was noted that the group named Storm‑0940 used the AI‑powered penetration‑testing framework called ARTEX to automate attacks against various sectors in September.

Privileged Access in Some Attacks Lasted Less Than Three Hours

According to Microsoft's assessment, a significant portion of the attacks achieved high‑privilege access in the target organizations' cloud infrastructures. In some cases, the time from the attackers' initial target‑identification phase to obtaining privileged access was under three hours. The finding highlighted how quickly automation could be employed in certain stages of the attacks.

A Wide Range of Sectors From Aviation to Finance Targeted

The report listed aviation and defense, automotive, chemical, energy, financial services, public institutions, legal, manufacturing, media, military organizations, semiconductors, software and technology companies among the targeted sectors. It also noted that think tanks and non‑profit organizations were on the target list.

Storm‑0940 Suspected in ConnectWise Breach

Microsoft also assessed that the Storm-0940 group was responsible for the supply-chain breach that was disclosed to the public shortly before. ConnectWise, in the statement it made on October 16, announced that it was investigating unauthorized access attempts linked to its ConnectWise Cloud Backup environment. Microsoft's assessment suggests a connection between the incident and a China‑linked cyber actor; however, this reference should be treated as part of Microsoft's threat intelligence assessment.