Microsoft says China-linked hackers used AI tool ARTEX against hundreds of organisations
In short
Microsoft said on 21 October (US time) that a hacker group linked to the Chinese government used an AI tool called ARTEX to attack hundreds of organisations worldwide since September. In some cases attackers took cloud administrator rights in under three hours. It is not clear whether the group was involved in recent attacks on Japanese companies.
Read the full story 2 min read
Microsoft said on 21 October (US time) that it had confirmed a hacker group linked to the Chinese government used artificial intelligence to carry out automated cyber attacks on hundreds of organisations around the world. Japanese outlets, including Kyodo-based reports, said Microsoft pointed to the case as a real example of AI sharply raising the speed and scale of attacks and urged vigilance. [ 1 , 4 , 5 , 6 , 7 , 8 ]
Microsoft calls the group Storm-0940. According to Mainichi Shimbun and Kyodo, it has been active since 2021 with the aim of stealing data. Microsoft said the group has used ARTEX since September or around September at the latest. Outlets describe the tool differently: Kyodo reports call it an open-source AI penetration-testing framework, the Yomiuri an AI agent that diagnoses system vulnerabilities, and Mainichi a Chinese AI agent that works autonomously once given instructions. [ 1 , 4 , 5 , 6 , 7 , 8 ]
The attacks used AI to automate research on targets and attempts to break in. The Yomiuri reported up to 2,900 login attempts a minute and a case in which critical administrator rights were taken within three hours. Kyodo reported that in some cases less than three hours passed between choosing a target and taking cloud administrator rights, and that reconnaissance, unauthorised logins and data exfiltration were believed to have been carried out with little human involvement. [ 1 , 5 , 6 , 7 ]
The reports name different sets of targets. The Yomiuri lists aerospace, defence and finance; Mainichi lists automotive, energy, financial services, software, government and media; Kyodo lists automotive, chemicals, finance, government, media and the military; TBS lists aerospace, automotive, finance, government, military and media. Microsoft examined login and other access records on its own cloud services. [ 1 , 4 , 5 , 7 , 8 ]
On Japan, the Yomiuri said a survey published on 19 October by GMO Cybersecurity by Ierae found ARTEX may have been used in attacks on about 80 Japanese companies. TBS said earlier research by a domestic security firm had confirmed ARTEX in attacks on several Japanese companies. Nikkei, Mainichi, TBS and the Yomiuri all say it is not clear whether Storm-0940 took part in those attacks; the Yomiuri adds that the same group may have been involved. [ 1 , 2 , 4 , 8 ]
Mainichi, citing Reuters, quoted a spokesperson for the Chinese embassy in the United States as saying that China cracks down on hacking in accordance with the law and opposes smears and attacks that use cybersecurity as a pretext. [ 4 ]
Why it matters
Microsoft pointed to the case as a real example of AI sharply raising the speed and scale of attacks, and urged vigilance. Japanese outlets stress the link to recent attacks on Japanese companies in which the same tool may have been used, though any involvement of the group is unconfirmed.
Key facts
- Microsoft announced on 21 October (US time) that a hacker group tied to the Chinese government had used AI to attack hundreds of organisations worldwide. [ 1 , 2 , 4 , 5 , 6 , 7 , 8 ]
- Microsoft calls the group Storm-0940; it has been active since 2021 and aims to steal data. [ 1 , 4 , 5 , 7 , 8 ]
- The group is reported to have used ARTEX, described as a Chinese AI tool, since September or around September at the latest. [ 1 , 4 , 5 , 6 , 7 , 8 ]
- In some cases it took less than three hours from target selection to taking administrator rights in the cloud. [ 5 , 6 , 7 ]
- In one case up to 2,900 login attempts a minute were made, according to the Yomiuri Shimbun. [ 1 ]
- Microsoft based its findings on login and other access records left on its own cloud services. [ 1 , 2 , 5 , 7 , 8 ]
- A survey published on 19 October by GMO Cybersecurity by Ierae said ARTEX may have been used in attacks on about 80 companies in Japan. [ 1 ]
Confirmed by several sources
- Microsoft announced it had confirmed that a hacker group linked to the Chinese government used AI to attack hundreds of organisations worldwide. [ 1 , 4 , 5 , 7 , 8 , 9 ]
- The group is called Storm-0940 and has been active since 2021 with the aim of stealing data. [ 4 , 5 , 7 , 8 ]
- The attacks used the AI tool ARTEX and have been running since September or around that time. [ 1 , 4 , 5 , 8 ]
- Microsoft has not established whether the group took part in attacks on Japanese companies. [ 1 , 2 , 4 , 8 ]
- Microsoft's findings came from records such as logins on its own services. [ 1 , 2 , 5 , 7 , 8 ]
Still unclear
- Whether Storm-0940 was involved in the attacks on Japanese companies. The Yomiuri Shimbun, Nikkei, Mainichi Shimbun and TBS all say this has not been made clear; the Yomiuri adds that the same group may have been involved.
- Which industries were targeted. Outlets list different sectors: aerospace, defence and finance (Yomiuri); automotive, energy, financial services, software, government and media (Mainichi); automotive, chemicals, finance, government, media and the military (Kyodo-based reports); aerospace, automotive, finance, government, military and media (TBS).
- How ARTEX is described. Yomiuri calls it an AI agent that diagnoses system vulnerabilities, Mainichi an autonomous Chinese AI agent, Kyodo-based reports an open-source AI penetration-testing framework, and Nikkei and TBS a Chinese AI tool.
- How far the attacks ran without human involvement. Kyodo-based reports say the group is believed to have carried out reconnaissance, unauthorised logins and data exfiltration with little human involvement; this is stated as an assessment.
What local media are saying
Timeline, local time
- The Yomiuri Shimbun publishes its report on 22 October on Microsoft's announcement of 21 October (US time). [ 1 ]
- Mainichi Shimbun publishes its report on 22 October, including the Chinese embassy's reaction relayed from Reuters. [ 4 ]
- Tokyo Shimbun publishes a Kyodo report on 22 October. [ 5 ]
- TBS NEWS DIG reports on 23 October that ARTEX was also used in attacks on several Japanese companies according to a domestic security firm's earlier research. [ 8 ]
- NHK publishes its report on 23 October. [ 9 ]