French headquarters of American multinational technology company Microsoft, is pictured outside on March 6, 2018 in Issy-Les-Moulineaux, a Paris’ suburb. (Photo by GERARD JULIEN / AFP) (Photo by GERARD JULIEN/AFP via Getty Images)Microsoft has warned that Chinese state-aligned hackers have unleashed a sophisticated new wave of artificial intelligence-powered cyberattacks targeting hundreds of organizations worldwide.The attacks are exploiting trusted software providers and gaining privileged access to corporate cloud systems in less than three hours.In an Oct. 21 report, Microsoft Threat Intelligence identified a China-linked hacking group known as Storm-0940 as responsible for an aggressive campaign involving ARTEX, an autonomous AI penetration-testing framework capable of conducting complex cyberattacks with minimal human involvement.Microsoft also attributed the recently disclosed ConnectWise software supply chain compromise to the group, raising concerns about the vulnerability of businesses, government agencies, and critical industries that depend on interconnected cloud services.The attacks targeted organizations across aerospace, defense, automotive manufacturing, energy, financial services, government, military, semiconductors and technology.”As early as September 2026, Storm-0940, a China-state aligned actor, used the agentic AI penetration testing framework ARTEX” to automate attacks against hundreds of organizations, Microsoft reported.The company warned that AI agents dramatically accelerate cyberattacks by operating continuously, pursuing multiple vulnerabilities simultaneously, and exploiting weaknesses before security teams can respond.Microsoft said the technology allows attackers to “scale their operations exponentially.”The scope of the campaign was staggering.Between Oct. 10 and 14, Microsoft recorded more than 151,000 failed login attempts targeting 327 accounts across eight organizations. At peak intensity, attackers generated approximately 2,900 failed authentication attempts per minute.Although Microsoft observed no successful logins during that particular password-spraying operation, the broader campaign demonstrated considerably more dangerous capabilities.Following the ConnectWise compromise, hackers exploited trusted application credentials to attempt access to more than 2,250 customer cloud environments.In multiple cases, Microsoft observed unauthorized reconnaissance, credential modifications, and attempts to obtain elevated administrative privileges.Some successful intrusions progressed from initial targeting to privileged cloud access in under three hours.The findings underscore growing concerns that Beijing-aligned cyber operations are entering a more dangerous phase as artificial intelligence transforms traditional hacking into automated, industrial-scale attacks.Storm-0940 has operated since at least 2021, according to Microsoft, historically using password spraying, vulnerable internet-facing applications and stolen credentials to penetrate corporate networks and steal information.But agentic AI represents a significant escalation.Unlike conventional hacking tools, autonomous agents can identify weaknesses, coordinate attacks and pursue additional access without requiring continuous human direction.U.S. intelligence agencies have repeatedly warned that Chinese government-backed hackers have penetrated critical American infrastructure, potentially positioning Beijing to disrupt electricity, water supplies, telecommunications, and transportation during a military confrontation.Former FBI Director Christopher Wray delivered one of the starkest warnings during congressional testimony in January 2024, identifying a Chinese hacking operation known as Volt Typhoon.”There has been far too little public focus on the fact that PRC hackers are targeting our critical infrastructure,” Wray told lawmakers, citing water treatment plants, electrical grids, pipelines, and transportation networks.In subsequent remarks, Wray warned China was developing the capability to “physically wreak havoc on our critical infrastructure at a time of its choosing.”The FBI disclosed that Chinese hackers had secretly infiltrated American networks using legitimate system administration tools, making their activities difficult to detect.Wray also testified that China’s hackers would outnumber FBI cyber personnel by at least 50 to 1 even if every FBI cyber agent and intelligence analyst focused exclusively on China.The threat extended beyond infrastructure.In November 2024, the FBI and Cybersecurity and Infrastructure Security Agency confirmed that Chinese-affiliated hackers had compromised multiple American telecommunications companies, stealing customer call records, and accessing private communications involving individuals engaged in government and political activities.The operation became known as Salt Typhoon.A 2025 U.S. intelligence assessment concluded that Beijing was developing sophisticated cyber capabilities to steal sensitive information and establish additional attack options for potential military conflict.A separate 2025 joint cybersecurity advisory detailed how Chinese state-sponsored hackers compromised telecommunications, and other networks worldwide, manipulated routers and maintained persistent access to sensitive systems.The Cybersecurity and Infrastructure Security Agency has also confirmed discovering and removing Chinese intrusions from American aviation, energy, water, and telecommunications infrastructure.Officials warn that these operations represent more than traditional espionage: They could enable coordinated disruption of essential services during a future crisis.The recent ConnectWise incident illustrates the particular danger of supply chain compromises.By exploiting software applications already trusted by customers, attackers can potentially bypass traditional authentication barriers and reach numerous downstream organizations.Microsoft emphasized that the attacks did not result from a compromise of or vulnerabilities in its own products, services, or corporate systems.The company also cautioned that successful authentication does not necessarily establish that customer information was accessed or stolen.Nevertheless, the potential consequences are substantial.Compromised cloud credentials can enable espionage, persistent unauthorized access, and interference with essential business operations. Disruptions to backup and recovery systems could further complicate efforts to restore affected services.Microsoft urged organizations to investigate suspicious application activity, review privileged access and follow ConnectWise’s containment guidance.© 2026 Newsmax. All rights reserved.
Click Here For The Original Source.
——————————————————–
