China-Linked Hackers Used AI to Target 200 Organizations: What Every Business Should Know

30 October 2026

Quick answer: CrowdStrike reports that China-linked hackers used AI-powered tools to automate attacks against roughly 200 organizations. Microsoft separately tracked a similar campaign tied to a group it calls Storm-0940, which used an AI penetration testing framework named ARTEX. The big lesson is that AI lets attackers work faster and at a much larger scale, so defenders need faster detection, tighter identity controls and regular patching.

What Happened?

Cybersecurity researchers have confirmed something many experts feared: state-linked hackers are now using artificial intelligence to run attack campaigns. CrowdStrike says China-linked actors used AI to go after around 200 organizations. Microsoft published its own findings in October 2026, describing a China-aligned group, tracked as Storm-0940, that used an AI-driven tool to compromise IT services firm ConnectWise and then target hundreds of other organizations worldwide.

The tool at the center of the story is ARTEX. It is an open-source, semi-autonomous penetration testing framework developed in China. Penetration testing tools were built to help security teams find weak spots before criminals do. In this case, attackers turned that same idea around and used it to find and exploit weak spots in real networks.

This is not a one-off. CrowdStrike linked ARTEX to attacks on South Korean financial institutions in September and October 2026. Japanese researchers at GMO Cybersecurity later reported that the same tool appeared in a wave of attacks on organizations in Japan, with several well-known companies named among those affected.

Why This Matters

For years, large-scale hacking needed skilled people, plenty of time and a lot of manual effort. AI changes that equation. An AI agent can scan systems, test login paths, try different exploits and adjust its approach without waiting for a human to guide every step. One small team can now do the work that once took a much bigger crew.

Microsoft summed up the shift by warning that hackers are pairing AI agents with attack methods that already exist, which sharply increases how many targets they can reach. In plain terms, the old tricks are not going away. They are simply being run faster and against far more victims at once.

How AI-Powered Cyberattacks Work

Understanding the basic flow helps you spot where to defend.

1. Automated reconnaissance. The AI maps a target’s public-facing systems, looking for outdated software, exposed services and misconfigured settings.

2. Smart exploitation. Instead of running a fixed script, the tool tests several approaches and picks what works. If one door is locked, it tries another.

3. Credential theft. CrowdStrike notes that AI-generated scripts are being used to dump stored credentials and wipe forensic evidence quickly. Stolen credentials let attackers move through a network looking like a normal user.

4. Lateral movement. Once inside, attackers move toward valuable systems. Because AI shortens each step, the time between first access and serious damage keeps shrinking.

5. Supply-chain access. Attacking a software or IT services provider is especially rewarding, because one breach can open the door to many of that provider’s customers.

The Bigger Picture From CrowdStrike

The 200-organization campaign sits inside a wider trend. CrowdStrike’s 2026 threat reporting shows China-linked groups were behind more than 58 percent of state-sponsored intrusions aimed at technology companies. The firm also reported that China-nexus activity grew by 38 percent in 2025, with the logistics sector seeing an 85 percent jump in targeting.

Other findings paint a similar picture:

• Attackers injected malicious prompts into legitimate generative AI tools at more than 90 organizations.
• North Korea-linked activity rose by over 130 percent, partly through AI-generated personas used to land remote jobs inside companies.
• A Russia-linked group deployed malware powered by a large language model to automate reconnaissance and document collection.
• CrowdStrike’s Adam Meyers described the situation as an AI arms race.

AI is both a weapon and a target. Criminals use it to attack faster, and they also try to compromise the AI systems companies depend on.

Who Is Most at Risk?

Almost any organization can be a target, but some groups face higher odds:

• Technology and IT service providers, because they hold access to many customers.
• Financial institutions, which hold valuable data and money.
• Logistics and manufacturing firms, which often run older systems that are hard to patch.
• Government, legal, energy and defense organizations, which attract espionage.
• Small and mid-sized businesses, which often have fewer security staff and become easy stepping stones into bigger partners.

Size is no shield. Automated tools do not care how big you are. They scan for weaknesses and go where the path is easiest.

How to Protect Your Organization

You do not need a giant budget to improve your odds. Focus on the basics and do them consistently.

Patch quickly. CrowdStrike found that a large share of vulnerabilities used by China-linked actors gave immediate system access, and many targeted internet-facing edge devices. Prioritize firewalls, VPNs, remote access tools and anything exposed to the internet.

Lock down identities. Use multi-factor authentication everywhere, preferably phishing-resistant methods. Remove accounts that are no longer needed and limit admin rights.

Watch your vendors. If a supplier is breached, you could be next. Ask partners about their security practices, and limit the access each vendor has to your systems.

Monitor for unusual behavior. AI-driven attacks move fast, so alerts that fire in minutes matter more than weekly log reviews. Consider managed detection and response if you lack an in-house team.

Secure your own AI tools. Review which AI platforms your staff use, control what data goes into them, and watch for prompt injection risks.

Back up and rehearse. Keep offline backups, and run a tabletop exercise so your team knows who does what when an incident hits.

Train your people. Fake CAPTCHA lures and phishing messages are rising. Short, regular awareness sessions help staff pause before they click.

What Comes Next?

Expect more of this, not less. Open-source AI security tools lower the barrier for anyone who wants to run complex attacks, and they will keep improving. Defenders will answer with their own AI for detection, triage and response, which means the contest will increasingly be machine against machine, with people setting strategy and making the final calls.

Governments and security vendors are likely to push for stronger disclosure rules, faster information sharing and tighter oversight of dual-use security tools. For businesses, the practical takeaway is simple: assume attackers have automation on their side, and build your defenses to match.

Final Thoughts

The story of China-linked hackers using AI against around 200 organizations is a clear signal that cyber defense has entered a new phase. Attacks are quicker, cheaper to run and easier to repeat. The good news is that strong fundamentals still work: patch fast, protect identities, vet vendors, monitor closely and train your team. Organizations that treat security as an ongoing habit rather than a yearly checkbox will be best placed to handle what comes next.

Frequently Asked Questions