China-linked hackers use AI security tool to target hundreds of global firms

The ARTEX Breach

A hacking group with ties to China has been identified using an artificial intelligence security tool to launch a massive wave of cyberattacks. As Chosunbiz reported, the group known as Storm-0940 utilized a Chinese open-source tool called ARTEX to breach a U.S. IT service provider named ConnectWise.

Instead of launching a direct, manual attack on every single company, the hackers used a more sophisticated method. They exploited the authentication framework of a trusted application to try and gain entry into multiple client environments at once. This allowed them to move laterally through systems that were already trusted by the organization's infrastructure.

How ARTEX Works

ARTEX is what security experts call a penetration-testing tool. These are programs designed by security professionals to find vulnerabilities in a network before a criminal can exploit them. However, ARTEX can be combined with AI models to automate the entire lifecycle of a cyberattack.

By using AI, the tool can handle everything from initial reconnaissance—the phase where hackers scout for weaknesses—to the final stage of data exfiltration, which is the unauthorized removal of data from a system. This automation allows a small number of hackers to target hundreds of organizations simultaneously across various sectors, including defense, government, and semiconductors.

Speed and Scale

The speed at which these AI-driven attacks occur is a primary concern for security teams. Microsoft noted that in some instances, the attackers were able to secure high-level access within just three hours of launching their initial move. This rapid progression leaves very little time for human defenders to react and shut down the intrusion.

The scale of the campaign was also significant. The hackers targeted hundreds of organizations globally. During one specific window between the 10th and the 14th of this month, they attempted a password-spraying attack—a method of trying many different passwords against many accounts—on 327 accounts across eight different organizations. While that specific attempt failed, the broader use of ARTEX has been linked to more than 100,000 data leaks at 16 domestic financial companies recently.

The Changing Cost of Crime

The integration of AI into cybercrime is fundamentally changing the economics of hacking. According to Microsoft's 2026 Digital Defense Report, AI is lowering the cost required to execute sophisticated attacks. Because the AI does the heavy lifting of scanning and identifying targets, attackers can achieve a much larger scale and operate with more autonomy than they could with manual methods.

This shift means that even smaller groups can now launch attacks that previously would have required a large team of skilled human operators. The automation provided by tools like ARTEX allows for a 'spray and pray' approach that is both highly efficient and difficult to contain once it begins. It creates a situation where the barrier to entry for high-level cybercrime is significantly lowered.

Defensive Strategies

To counter these AI-powered threats, security experts are shifting their focus. Microsoft emphasizes that organizations must manage more than just human accounts; they must also audit the permissions granted to apps and AI agents. If an AI tool or a trusted app has broad permissions, it can be used as a bridge for hackers to move deeper into a network.

The primary defense strategy involves reducing unnecessary access rights. By strictly controlling administrator privileges, companies can ensure that even if a hacker gains access to one part of a system, they cannot easily move to the most sensitive areas. This 'least privilege' model is becoming essential as AI tools continue to make it easier for attackers to automate their way into private data.