MS: “China-Linked Hackers Attack Hundreds of Global Organizations Using ARTEX AI Tool”

1. Overview

On October 21, 2026 (local time), Microsoft (MS) announced that a hacking group linked to China had targeted hundreds of organizations worldwide with an AI-powered penetration-testing tool. The group, which Microsoft named “Storm-0940,” reportedly conducted a campaign using ARTEX, an open-source tool from China, by compromising US IT services provider ConnectWise.

In its announcement, Microsoft also referenced reports that ARTEX had been used in a personal information breach involving South Korean financial companies. Since early this month, more than 100,000 records have reportedly been leaked from over 16 financial companies in South Korea. Japan’s Kyodo News reported the incident as breaking news, while Yonhap News TV reported that attacks using the same tool had also occurred in Japan.

2. Microsoft’s announcement and attack methods

According to Yonhap News, citing Reuters, Microsoft said that Storm-0940 attacked ConnectWise as part of a campaign targeting hundreds of organizations worldwide using ARTEX. ARTEX is a framework for identifying system vulnerabilities. It can be configured to use any AI model to automate tasks and independently carry out activities such as reconnaissance and data exfiltration. Microsoft said the group had been using ARTEX as early as September.

ConnectWise is a managed service provider (MSP) that handles IT operations for small and medium-sized businesses. Rather than breaking into companies individually, the hacking group is believed to have tried to access multiple tenants (subscriber organizations) through a trusted app identity. According to Microsoft, the attackers used a trusted identity associated with the ConnectWise app to authenticate without an interactive login. From the 10th to the 14th of this month, they attempted password-spraying attacks against 327 accounts across eight organizations, causing more than 151,000 failed login attempts, but did not succeed in authenticating.

The targets spanned a wide range of sectors, including aerospace, defense, automotive, chemicals, energy, finance, government, legal services, semiconductors, software, and think tanks. Microsoft said most of the attacks were unsuccessful, but explained that Storm-0940 obtained “privileged cloud persistence” at multiple organizations in a short period. In some cases, the group gained privileged access within three hours of initially targeting a victim. In its subtitle, News1 summarized this as: “Automating hacking with AI… administrator-level cloud access obtained at some targets.”

Meanwhile, in a statement on the 16th, ConnectWise said it was “investigating recent attempts at unauthorized access related to its cloud backup environment.”

3. Connection to the South Korean financial-sector incident

Microsoft also referenced reports that ARTEX was used in attacks related to a personal information breach targeting South Korean financial institutions. South Korea’s financial authorities have said that more than 100,000 records were leaked from over 16 financial companies since early this month. US cybersecurity firms Recorded Future and CrowdStrike identified the actors behind the incident as Chinese-speaking individuals who used ARTEX alongside several AI models.

Among South Korean reports, Yonhap News and Saengsaeng Biz Plus foregrounded the use of the same tool as in the attacks on South Korean banks in their headlines. A YouTube video by Arirang News also said that the same tool had been identified in the breach of South Korea’s financial sector.

4. The damage spreads to Japan

The following day, Yonhap News TV reported from its Beijing correspondent that the same Chinese AI tool, ARTEX, had also been used in hacking attacks targeting Japanese companies. Around 80 Japanese companies in the finance, insurance, and logistics sectors were targeted, and traces of the tool were found on six attack servers. Eight of the targeted companies said their information had been leaked.

The Japanese government is reportedly investigating whether foreign actors may have been involved in a series of cyberattacks. On the 13th, Japanese Minister in Charge of Economic Security Kimi Onoda said, “Personal information leaks are occurring one after another as a result of cyberattacks targeting private companies and others,” adding that relevant government agencies were working together to urge companies to exercise caution. Yonhap News TV reported that, amid cooling China–Japan relations over the Taiwan issue, cyberattacks had emerged as a new source of tension.

5. Authenticity debate

The central question is whether the individual hacking incidents in South Korea, Japan, and elsewhere can be attributed to a single China-linked actor behind the campaign described by Microsoft as the work of Storm-0940. Reports vary between describing the actors as “linked to the Chinese government” and “linked to China,” so whether the group was a state-level organization is also at issue.

5.1. The case for a series of attacks by a single actor

The first point raised by this side is that the same tool has repeatedly been identified in multiple regions. Microsoft directly referenced reports that ARTEX was used in attacks on South Korean financial institutions, and traces of the same tool were found on six attack servers in Japan. The reasoning is that the appearance of the same AI tool in different countries warrants suspicion of a connection.

The assessments of the two cybersecurity firms are also cited as evidence. Recorded Future and CrowdStrike identified the actors behind the South Korean incident as Chinese-speaking individuals who used ARTEX alongside several AI models. Japan’s Kyodo News reported the story as breaking news using the phrase “linked to the Chinese government.” Microsoft’s account also noted that the targets spanned sectors including aerospace, defense, semiconductors, government, and think tanks, and that the group was believed to have tried to access multiple tenants through an MSP.

5.2. The case that it is too early to draw conclusions

The opposing side first points out that ARTEX is a publicly available open-source tool. The fact that a tool anyone can use was found in multiple incidents does not, by itself, establish that the same organization was responsible. Microsoft itself only referred to “reports” that ARTEX had been used in the South Korean incident, and the actors identified as being behind that incident were “Chinese-speaking individuals,” not Storm-0940. Reports have not confirmed that the two are the same group.

There is also disagreement over the scale of the damage. Microsoft said most of the attacks were unsuccessful, and the password-spraying attempts did not result in successful authentication. The reported ConnectWise statement said it was investigating “attempts” at unauthorized access. The phrase “linked to the Chinese government” appeared in Kyodo News’ breaking report, while South Korean reports such as Yonhap News used “linked to China.” No specific evidence supporting state-level involvement has appeared in the reports available so far.

Neither side’s claims have yet become established facts. Further investigation is needed to determine whether the incidents in South Korea and Japan were part of a single operation or whether a government was involved.

6. Trivia

• FM Korea users shared a screenshot of a post that Japanese outlet 47NEWS had published on X: “【Breaking】Chinese government-linked group attacks using AI, Microsoft announces.” As of 10:29 p.m. on the 22nd, the post had received about 266,000 views. The original breaking report by Kyodo News is marked as having been filed at 10:28 p.m. on the 22nd.
• Saengsaeng Biz Plus’s list of related articles also included one titled “Will the truth behind the financial company hack emerge… CrowdStrike: ‘We suspect 26-year-old YY living in Guangdong, China’.” However, the article’s contents could not be confirmed.