Artificial intelligence / news brief
Microsoft says AI agents accelerated a ConnectWise-linked campaign against 2,250 cloud tenants
- Event
- Published
Microsoft attributed a ConnectWise-linked campaign to the China-aligned Storm-0940 group and says the attackers used the open-source ARTEX agent framework for reconnaissance, password spraying and OAuth application abuse. More than 2,250 Microsoft 365 tenants saw attempted sign-ins at peaks of 2,900 per minute, but Microsoft says most targeting failed and exposure does not prove data access.
Why it matters
The incident shows how stolen application identities and agent automation can compress cloud intrusion timelines beyond manual response cycles.
Sources
- AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise (external site)Microsoft Security · primary source ·
- China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants (external site)CSO Online · coverage ·