Microsoft said on the 21st, U.S. time, that a hacking group linked to the Chinese government had used ARTEX, a Chinese AI tool, to carry out cyberattacks. After reviewing records from its cloud services and other sources, the company said a group it calls “Storm-0940” had used ARTEX since September in attacks involving hundreds of companies and other organizations around the world. It has not disclosed whether the group was involved in attacks targeting Japanese companies.
It wasn’t “AI carrying out an attack,” but people using AI to attack
When people hear that “AI has started launching cyberattacks,” they may imagine a scene from a movie, with machines running amok on their own. But what Microsoft described this time is a little different: a human hacking group said to be linked to a government was using an AI tool. That is what has been confirmed.
The distinction may seem minor, but it has significant implications. Did AI itself become the agent of the attack, or are human attackers delegating part of their work to AI? If it’s the former, we may need to fundamentally rethink how we defend against attacks. If it’s the latter, it may be more accurate to see this as the ongoing contest between attackers and defenders accelerating with a new tool.
The specific capabilities of ARTEX and the stages of the attack in which it was used are not detailed here. What is clear is that a Chinese AI tool was in the hands of a group described as government-backed, and that Microsoft identified its use by reviewing its own records.
Hundreds of companies—and what we know about the impact on Japan
According to Microsoft, Storm-0940 has used ARTEX since September in attacks involving hundreds of companies and other organizations around the world. The figure of hundreds suggests a sustained operation with a broad reach, rather than a single incident.
At the same time, it has not been disclosed whether Japanese companies were targeted. The global activity and any damage in Japan need to be considered separately. The reality is that we cannot say either that Japan must have been affected because hundreds of companies worldwide were involved, or that Japan was unaffected because no Japanese organizations have been named.
The key point is that even when no damage has been publicly confirmed, security professionals should be prepared on the assumption that their own organizations could be targeted using the same methods.
What the name Storm-0940 means
“Storm-0940” is a name Microsoft uses to classify a hacking group. Microsoft tracks groups whose organizations have not yet been fully identified by assigning them the “Storm” label and a number. In this case, links to the Chinese government have been alleged. The impersonal name is also a way to group and manage observed activity without rushing to conclusions.
Defenders must learn to recognize how AI is being used
What happens to corporate defenses as attackers begin using AI? That is probably the central question raised by this news. If AI reduces the effort required to prepare an attack, the same number of people could target more organizations. It is entirely possible that the number of attacks will rise or that their wording and methods will become more refined.
Microsoft made this finding by examining records from its own cloud services. In other words, it was able to trace the attackers’ activity through accumulated usage logs. Having systems in place to collect logs and detect anomalies could be the starting point for recognizing attacks in the AI era.
For executives and managers, a practical response is to use this as an opportunity to review the basics—password management, multifactor authentication and access-log reviews—before bracing for “AI attacks.” Even with new tools, the underlying dynamic remains unchanged: attackers exploit weaknesses in the foundations of an organization’s defenses.
We have entered an era in which AI is available to attackers and defenders alike. The ARTEX case is worth following as an event that has put this reality into focus with specific numbers and names.
Comments