China's Storm-0940 Used AI Agents to Hit 300+ Accounts at 2,900 Attempts Per Minute
What happened
Microsoft's threat intelligence team attributed a mid-October 2026 attack campaign to Storm-0940, a China-linked group. The report is covered by China APT Uses AI Pentest Tool Artex in ConnectWise Attacks. The group used Artex, an open-source tool designed to automate penetration testing, to attack customer environments connected through the ConnectWise remote-access platform. At its peak, the campaign generated more than 2,900 attack attempts per minute across more than 300 accounts at eight organizations. Affected sectors included defense, financial services, government, and energy. Critically, after bypassing initial login controls, AI agents continued working autonomously: modifying credentials, escalating their own access privileges, and mapping internal systems without further human direction from the attackers. This incident follows a pattern identified by Microsoft earlier this year, where attackers are winning the AI race and adversarial AI use outpaces defensive controls.
Why it matters
- ·AI-accelerated attacks at nearly 3,000 attempts per minute compress the window between first access and serious damage to minutes, making manual detection and response practically insufficient. Organizations in defense, financial services, government, and energy sectors face the highest immediate exposure and should treat this as an active threat category, not a theoretical one.
- ·The autonomous post-access behavior, where AI agents changed credentials and raised their own access levels without attacker input, directly challenges the assumption that stopping initial unauthorized login is enough. Existing access controls designed around human-speed attackers may not detect or block this class of AI-driven, self-directed lateral movement.
- ·ConnectWise's role as a widely used remote-access platform means this attack propagated through a trusted third-party tool already present in many enterprise environments. Vendor access channels that receive less scrutiny than internal systems are now a demonstrated entry point for AI-accelerated nation-state attacks.
Governance controls affected
What to do now
- ☐Ask your IT or security team to pull a list of all remote-access tools like ConnectWise that have standing access to your environment, and verify that each connection requires multi-step identity verification rather than a single password.
- ☐Review whether your identity and access monitoring systems can detect and alert on rapid, repeated login attempts at machine speed, specifically thresholds that would catch thousands of attempts per minute from a single source or tool.
- ☐Ask your security team whether AI agents or automated tools operating inside your environment after authentication are subject to the same activity logging and anomaly alerts as human users, and identify any gaps.
- ☐Confirm that service accounts and application identities used by third-party platforms like ConnectWise are scoped to only what they need, and that any escalation of those permissions requires human approval.
- ☐Brief your incident response team on the Artex tool and Storm-0940 indicators of compromise published by Microsoft so that your team can scan logs for evidence of this specific campaign in your environment.
What to watch next
Compliance teams should monitor whether US sector regulators, particularly those covering financial services, defense contractors, and energy operators, issue specific guidance on AI-accelerated nation-state threats following this disclosure. The Five Eyes Guidance on the Careful Adoption of Agentic AI Services already frames autonomous post-access agent behavior as a category requiring explicit containment controls. This incident will likely sharpen regulatory expectations in that direction. Watch for updates from ConnectWise and Microsoft on platform-level mitigations. Also monitor for enforcement or notification obligations that may arise for the eight organizations confirmed to have been hit across regulated sectors.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- Regulators, litigants, and attackers are all moving faster than most organizations' AI governance frameworks, shifting leverage away from deployers and toward those who can prove control, accountability, and honest disclosure.21 Oct
- Three separate incidents this week reveal that AI vendors cannot be trusted to self-police, and that harm from deployed agents can run unchecked for months before anyone inside the organization notices.15 Oct
Free every Thursday. Unsubscribe anytime.