---
title: "Microsoft: China-linked hackers used AI to target hundreds globally"
publication: "MediaBias News"
url: "https://mediabias.news/conflict/microsoft-china-linked-hackers-used-ai-to-target-hundreds-globally"
api: "https://mediabias.news/api/v1/stories/microsoft-china-linked-hackers-used-ai-to-target-hundreds-globally"
markdown: "https://mediabias.news/conflict/microsoft-china-linked-hackers-used-ai-to-target-hundreds-globally.md"
audio: "https://mediabias.news/api/audio/microsoft-china-linked-hackers-used-ai-to-target-hundreds-globally"
category: "Conflict & Security"
area: "China"
published: "2026-10-22T11:25:11.630Z"
source_reported: "2026-10-22T08:42:18.000Z"
updated: "2026-10-22T11:25:11.630Z"
trust_score: 76
critic_score: 85
hype_score: 12
assessment_type: "coverage-and-source-reporting-analysis"
fact_check_status: "not-performed"
coverage_measured: "2026-10-22T13:00:23.685381+00:00"
---

# Microsoft: China-linked hackers used AI to target hundreds globally

*Storm-0940 group exploited ConnectWise to gain privileged cloud access, Microsoft stated.*

**Scores for the source reporting** (0-100, assessing the original journalism this article was written from, not this write-up): 

- Trust 76 of 100, higher is better. Trust 76 – named CEO source, two independent outlets, Microsoft attribution, specific figures, and dated statement support the report.
- Craft 85 of 100, higher is better. Critic 85 – quotes from CEO and embassy, clear facts vs comments, specific numbers, next steps, coherent narrative.
- Hype 12 of 100, lower is better. Hype 12 – measured language, no clickbait, headline matches article content.

Scored by MediaBias News; method at https://mediabias.news/methodology.

**The short version**

- Microsoft has identified a hacking group, Storm-0940, as being linked to the Chinese state.
- The group used an AI-driven penetration testing framework called ARTEX to compromise IT services firm ConnectWise.
- The campaign targeted hundreds of organizations across numerous sectors globally.
- Storm-0940 achieved privileged cloud persistence, allowing high-level access that could remain after cleanup.

A hacking group identified by Microsoft as Storm-0940, described as Chinese state-aligned or China-linked, used an open-source penetration testing framework called ARTEX. This tool, which can automate tasks using AI models, was employed in a campaign that compromised IT services firm ConnectWise. Microsoft stated that the campaign targeted hundreds of organizations across sectors including aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks, and non-profit organizations.

ConnectWise CEO Manny Rivelo confirmed that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup, based on Microsoft's analysis and available evidence. Rivelo stated that ConnectWise had contained affected application connections and was restoring services in controlled phases, but noted these actions did not remove unauthorized access that might have been established within individual customer tenants, requiring separate review. Microsoft reported that Storm-0940 achieved privileged cloud persistence, a form of high-level access that could remain even after cleanup efforts. The group attempted access to more than 2,250 Microsoft 365 tenants, with up to 2,900 sign-in attempts per minute.

A spokesperson for the Chinese Embassy in Washington stated that China opposes and fights hacking activities in accordance with the law, and opposes smears and attacks against China under the excuse of cybersecurity issues.

## Disagreement on timing

Microsoft reported that Storm-0940 targeted hundreds of organizations in September using AI-powered ARTEX, with some attacks gaining privileged access in less than three hours, according to Haberler. In contrast, Hindustan Times and Rappler reported Microsoft stated the attack occurred on Wednesday, October 21.

## What the coverage left out

None of the left, centre, or right-rated reports printed below mention the specific figure of 2,900 sign-in attempts per minute that Microsoft reported Storm-0940 made. Additionally, only the unrated digest from Cyber Security News and the right-rated digest from India Today mentioned that the campaign accelerated cloud intrusions and left defenders little time to respond.

## Who covered it

Shares of the 17 covering outlets with a published leaning rating:

- Left: 6% (1)
- Centre: 47% (8)
- Right: 47% (8)

17 of 34 covering outlets carried no usable leaning rating and were excluded from those percentages. Coverage measured 2026-10-22T13:00:23.685381+00:00.

**Coverage watch:** developing. Checked 7 times; 0 checks found a material change. Most recently checked 2026-10-22T13:15:13.419Z.

## How the sides framed it

### Left

- Rappler, the single left-rated report, led with the headline "Chinese-linked hackers compromise ConnectWise, target hundreds in global attack." The report stated that a Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise ConnectWise as part of a global campaign targeting hundreds of organizations. It included statements from ConnectWise CEO Manny Rivelo and a spokesperson for the Chinese Embassy in Washington. The report also detailed the use of ARTEX and the sectors targeted.

### Centre

- The centre-rated reports from Hindustan Times, Reuters, Channel News Asia, WTVB, and CyberScoop all led with headlines indicating a compromise of ConnectWise by Chinese-linked hackers using an AI tool, as stated by Microsoft. These reports highlighted Microsoft's tracking of the group as Storm-0940 and its use of the ARTEX framework. They also included statements from ConnectWise CEO Manny Rivelo and the Chinese Embassy spokesperson. The centre-rated coverage detailed the broad range of sectors targeted and the achievement of privileged cloud persistence by Storm-0940.

### Right

- The right-rated reports from The Straits Times, India Today, Moneycontrol, CNBC-TV18, and news-pravda.com focused on Microsoft's attribution of the attack to Chinese-linked hackers using AI tools. Headlines consistently mentioned ConnectWise being compromised and hundreds of organizations being targeted. These reports noted the use of ARTEX by Storm-0940 and the achievement of privileged cloud persistence. India Today specifically mentioned the acceleration of cloud intrusions and limited response time for defenders.

**Provisional coverage gap:** left. The watch is not closed, so this is not yet a settled blindspot finding.

## Factuality profile of the covering outlets

These are published factuality ratings of the outlets, not a verdict on whether this story or its claims are true.

- veryLow: 1
- mixed: 6
- high: 7
- unknown: 17
- veryHigh: 3

## Verification scope

This page compares coverage and scores the source reporting. It is not a ClaimReview verdict on whether the underlying event or claim is true.

## Original reporting this was written from

- [Anadolu Ajansı](https://aa.com.tr/en/science-technology/chinese-linked-hackers-used-ai-in-connectwise-breach-microsoft/4097217) — Chinese-Linked Hackers Used AI in ConnectWise Breach: Microsoft
- [大紀元時報](https://epochtimes.jp/2026/10/391672.html) — Chinese Communist Party-Backed Hackers Used AI to Attack Hundreds of Organizations, Microsoft Reports.
- [The Register](https://theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687) — Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenants
- [OfficeChai](https://officechai.com/ai/chinese-state-hackers-used-ai-agent-artex-to-breach-over-2250-microsoft-365-tenants-in-hours-microsoft-says) — Chinese State Hackers Used AI Agent 'ARTEX' To Breach Over 2,250 Microsoft 365 Tenants In Hours, Microsoft Says
- [TokenPost](https://tokenpost.com/news/technology/37648) — Storm-0940 Tried to Access More Than 2,250 Microsoft 365 Tenants
- [Hindustan Times](https://hindustantimes.com/world-news/it-firm-connectwise-hit-by-china-linked-hackers-in-targeted-global-attack-says-microsoft-101792653715782.html) — IT firm ConnectWise hit by China-linked hackers in targeted global attack, says Microsoft
- [NEWS9 LIVE](https://news9live.com/technology/tech-news/china-storm-0940-ai-hackers-2900-login-attempts-microsoft-3018028) — China-linked Storm-0940 hackers use AI tool ARTEX to launch 2,900 login attempts per minute
- [Unknown](https://chosun.com/economy/tech_it/2026/10/22/GE2WINBVMM2GIOBWGZSGGNZRMQ) — China-Linked Hackers Infiltrate U.S. IT Firms Using AI… Targeting Hundreds Simultaneously
- [大纪元 Epoch Times](https://epochtimes.com/b5/26/10/22/n14874523.htm) — Connévis Cloud Was Hacked, Named Microsoft, CCP Hackers Used AI
- [CSO Online](https://csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html) — China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants
- [Cyber Security News](https://cybersecuritynews.com/china-linked-hackers-use-artex-ai) — China-Linked Hackers Use ARTEX AI to Target 2,250 Microsoft 365 Tenants After ConnectWise Breach
- [ekonomim.com](https://ekonomim.com/sektorler/teknoloji/microsofttan-siber-saldiri-alarmi-yuzlerce-kurulus-hedefte-haberi-926300) — Microsoft Issues Cyberattack Alert: Hundreds of Organizations Targeted.
- [news-pravda.com](https://news-pravda.com/world/2026/10/22/2685690.html) — Chinese-linked hackers compromise ConnectWise, Microsoft says
- [coinstats.app](https://coinstats.app/news/af04f36fbc2274ab1dff2deffbc901bf0b3193d067801cd1f16ac145d3ed7d5d_Chinese-hackers-target-hundreds-of-organizations-in-AIpowered-ConnectWise-breach) — Chinese hackers target hundreds of organizations in AI-powered ConnectWise breach
- [Cryptopolitan](https://cryptopolitan.com/chinese-hackers-breach-connectwise-using-ai) — Chinese hackers target hundreds of organizations in AI-powered ConnectWise breach
- [CNBC-TV18](https://cnbctv18.com/technology/china-linked-hackers-used-ai-tool-to-breach-connectwise-and-target-firms-worldwide-says-microsoft-20016728.htm) — China-linked hackers used AI tool to breach ConnectWise and target firms worldwide, says Microsoft
- [dunya.com](https://dunya.com/dunya/microsofttan-kuresel-siber-saldiri-uyarisi-yuzlerce-kurulus-hedef-alindi-haberi-844821) — Microsoft Warns of Global Cyberattack: Hundreds of Organizations Targeted - Dünya Newspaper
- [Rappler](https://rappler.com/technology/chinese-linked-hackers-compromise-connectwise-global-attack) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack
- [Asia One](https://asiaone.com/china/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-microsoft-says) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
- [India Today](https://indiatoday.in/technology/news/story/microsoft-says-chinese-hackers-used-ai-agents-to-attack-hundreds-of-organisations-worldwide-3022422-2026-10-22) — Microsoft says Chinese hackers used AI agents to attack hundreds of organisations worldwide
- [Unknown](https://aajtak.in/technology/tech-news/story/connectwise-hack-chinese-hackers-storm-0940-ai-artex-ttecr-dskc-2676821-2026-10-22) — Chinese Hackers Wreak Havoc, Using AI to Target Victims, Threatening Companies Worldwide.
- [Habertürk](https://haberturk.com/dunya/microsoft-tan-siber-saldiri-aciklamasi-3921580) — Microsoft Issues Statement on Cyberattack
- [cybernoz.com](https://cybernoz.com/microsoft-pins-connectwise-supply-chain-attack-to-china-state-aligned-threat-group) — Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
- [The Straits Times](https://straitstimes.com/world/united-states/chinese-linked-hackers-compromise-connectwise-target-hundreds-in-global-attack-microsoft) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack: Microsoft
- [Haberler](https://haberler.com/ekonomi/microsoft-storm-0940-in-yapay-zekayla-yuzlerce-20353815-haberi) — Microsoft Reported that Storm-0940 Targeted Hundreds of Organizations with Artificial Intelligence.
- [National Cyber Security](https://nationalcybersecurity.com/chinese-linked-hackers-compromise-connectwise-target-hundreds-in-global-attack-microsoft-says-hacking-cybersecurity-infosec-comptia-pentest-hacker) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker - National Cyber Security Consulting
- [Moneycontrol](https://moneycontrol.com/news/business/companies/chinese-linked-hackers-compromise-connectwise-target-hundreds-in-global-attack-microsoft-14057069.html) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack: Microsoft
- [CyberScoop](https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940) — Microsoft pins ConnectWise supply-chain attack to China-state aligned threat group
- [WTVB](https://wtvbam.com/2026/10/21/chinese-linked-hackers-compromise-connectwise-target-hundreds-in-global-attack-microsoft-says) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
- [Reuters](https://reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
- [Channel News Asia](https://channelnewsasia.com/business/chinese-linked-hackers-compromise-connectwise-target-hundreds-in-global-attack-microsoft-says-6480406) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
- [PressNewsAgency](https://pressnewsagency.org/chinese-linked-hackers-compromise-connectwise-target-hundreds-in-global-attack-microsoft-says) — Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
- [IT Security News - cybersecurity, infosecurity news](https://itsecuritynews.info/ai-driven-large-scale-nation-state-campaign-using-artex-enables-supply-chain-compromise) — AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
- [Crypto Briefing](https://cryptobriefing.com/microsoft-storm-0940-artex-ai-attacks) — Microsoft links Storm-0940 to AI-driven attacks using ARTEX framework

## Questions

**What is Storm-0940?**

Storm-0940 is the name Microsoft uses to track a hacking group described as Chinese state-aligned or China-linked. This group used an AI-driven penetration testing tool called ARTEX to compromise IT services firm ConnectWise as part of a global campaign targeting hundreds of organizations.

**How did the hackers compromise ConnectWise?**

The hackers, Storm-0940, used an open-source penetration testing framework called ARTEX, which can automate tasks using AI models. This tool was employed to compromise ConnectWise, allowing the group to achieve privileged cloud persistence and gain high-level access.

**What kind of organizations were targeted?**

The campaign targeted hundreds of organizations across a wide range of sectors. These included aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks, and non-profit organizations.

**What was the impact of the breach?**

Storm-0940 achieved privileged cloud persistence, meaning they gained high-level access that could remain even after cleanup efforts. They attempted access to over 2,250 Microsoft 365 tenants, with a high volume of sign-in attempts per minute, potentially allowing them to maintain access within customer environments.

---

MediaBias News — https://mediabias.news. Reproduced from https://mediabias.news/conflict/microsoft-china-linked-hackers-used-ai-to-target-hundreds-globally. Please cite as: MediaBias News, "Microsoft: China-linked hackers used AI to target hundreds globally", https://mediabias.news/conflict/microsoft-china-linked-hackers-used-ai-to-target-hundreds-globally