Microsoft: China-aligned hackers used ARTEX AI agents to hit 2,250+ M365 tenants
rickasaurus · x · 2026-10-23
Microsoft says Storm-0940, a China-state-aligned group, used the agentic AI pentesting framework ARTEX to exploit the ConnectWise supply-chain breach and target 2,250+ Microsoft 365 tenants.
- Just 4 stolen app credentials generated 200+ sign-ins in under four minutes; time from targeting to privileged access was sometimes under 3 hours.
- A prior campaign fired 151,000+ password-spray attempts across 8 organizations (peak 2,900 failed logins/min) with zero success — but trusted ConnectWise app identities bypassed those defenses.
- Post-access, the AI agents modified credentials and privileged roles to plant backdoors that persist even after the compromised app is disabled.
Microsoft's takeaway: threat actors are integrating agentic AI into offensive workflows, scaling attacks exponentially since agents work around the clock and probe multiple breach paths in parallel.
More from AGI Musings
- Investor: If AI is a bubble, it's the weirdest one ever seen — robleclerc · 2026-10-23
- Chamath: Banks will block AI agents via terms of service before anything else — nicolechirps · 2026-10-23
- AI researcher: Claude finally finished tedious research tasks I gave up on years ago — MikePFrank · 2026-10-23
- Sam Altman: AI should bring a Renaissance, not another Industrial Revolution — imjustnewatai · 2026-10-23
- Reddit thread argues safety research is indistinguishable from capabilities research — ResultBackground2450 · 2026-10-23
- Avoid galaxy-brained reasoning by taking naive positions on crucial considerations — jessi_cata · 2026-10-23