China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Summary

Microsoft attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned actor, which used the closed-source ARTEX agentic AI penetration testing framework to automate scanning, password spraying and OAuth application abuse against hundreds of organizations since September 2026. Between October 10 and 14, 2026, its infrastructure ran a cross-tenant password-spray campaign against 327 accounts across eight organizations, and on October 15 the AI agents gained control of ConnectWise cloud application identities and used them to authenticate to customer environments.

Topics

• AI agents
• Model and package supply chain

Related items

• MediumChinese hackers spied on thousands of companies after breaching IT giant ConnectWiseSame vendor · TechCrunch (Security)
• InfoBill Gates says to prepare for 20 years of ‘tumultuous’ AI disruptionSame vendor · The Verge (AI)
• MediumARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsSame vendor · Wiz Research Blog
• MediumChina-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantsSame vendor · CSO Online
• InfoAI firms say UK has a year to head off datacentre protests before construction is threatenedSame vendor · The Guardian Technology