{"data":{"id":"9f6d04d8-bb67-46c2-96ed-ebcb3002307a","title":"China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants","summary":"Microsoft Threat Intelligence attributed an attack to Storm-0940, a China-state-aligned actor that compromised a ConnectWise cloud backup application and used the open-source ARTEX agentic AI framework. The group used the stolen identities of ConnectWise cloud apps to sign in to more than 2,250 Microsoft 365 tenants at up to 2,900 attempts per minute, in some cases gaining privileged cloud access in under three hours. Microsoft said the activity did not stem from a flaw in its own products.","solution":"N/A -- no mitigation discussed in source.","labels":["security","industry"],"sourceUrl":"https://www.csoonline.com/article/4239028/china-linked-hackers-used-agentic-ai-in-attack-on-2250-microsoft-365-tenants.html","publishedAt":"2026-10-22T11:47:38.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["other"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Microsoft"],"affectedVendorsRaw":["Microsoft 365","ARTEX","ConnectWise Cloud Backup","Microsoft Graph"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-22T11:47:38.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity","availability"],"aiComponentTargeted":"agent","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null}}