{
 "id": "TR-2026-026",
 "status": "published",
 "title": "China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack",
 "date": "2026-10-15",
 "window": "September 2026 - October 2026",
 "ai_role": "attacker",
 "category": "incident",
 "summary": "Microsoft disclosed that the China state-aligned actor Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework, in the compromise of the ConnectWise Cloud Backup application. The agents automated scanning, password spraying and abuse of OAuth applications at downstream victims. After gaining control of the identities of multiple ConnectWise cloud applications, they authenticated to customer environments, and in some cases carried out Microsoft Graph and directory operations such as credential changes and privilege-related modifications. Other threat actors were also reported to be using ARTEX.",
 "attacker": {
  "description": "Storm-0940, a China state-aligned threat actor, using AI agents built on the ARTEX framework; ARTEX was also used by other actors, including the cluster Recorded Future tracks as TAG-217"
 },
 "defender": {
  "description": "ConnectWise and its downstream customer organizations across many sectors, including aerospace and defense, energy, financial services, government and technology"
 },
 "scale": "Hundreds of organizations targeted since September 2026; attempted sign-ins to more than 2,250 tenants at up to 2,900 per minute; a password-spray campaign against 327 accounts at eight organizations from October 10 to 14, 2026, with over 151,000 failed logons (more than 111,000 on October 11); in some cases privileged access was reached in under 3 hours; Wiz observed sessions lasting 24-30 hours",
 "impact": "The agents gained control of multiple ConnectWise cloud application identities and used them to access customer environments, and a portion of attacks resulted in privileged access to cloud infrastructure. They also modified application credentials in ways that could persist as a backdoor. ConnectWise temporarily shut down services and is restoring them in phases.",
 "tactics": [
  "TA0001",
  "TA0003",
  "TA0004",
  "TA0006",
  "TA0007",
  "TA0043"
 ],
 "timeline": [
  {
   "date": "2026-08-17",
   "text": "Recorded Future saw activity linked to TAG-217 testing remote access infrastructure and conducting internet scanning.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-09",
   "text": "Storm-0940 began ARTEX-driven attacks on hundreds of organizations, per Microsoft.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-10-10",
   "text": "An automated cross-tenant password-spray campaign began against 327 accounts at eight organizations, running through October 14.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-10-11",
   "text": "Failed logons peaked at 2,900 per minute, with over 111,000 failures that day.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-10-15",
   "text": "The AI agents gained access to the identities of multiple ConnectWise cloud applications and used them to authenticate to customer environments.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-10-22",
   "text": "Microsoft disclosed Storm-0940 as behind the ConnectWise Cloud Backup compromise.",
   "tier": null,
   "source": "1"
  },
  {
   "date": "2026-10-23",
   "text": "Wiz follow-up analysis reported Storm-0940 expanding attempted supply chain compromises into other software sectors.",
   "tier": null,
   "source": "1"
  }
 ],
 "lessons": [],
 "models_named": [
  {
   "name": "DeepSeek",
   "role": "attacker"
  },
  {
   "name": "GLM",
   "role": "attacker"
  },
  {
   "name": "Grok",
   "role": "attacker"
  },
  {
   "name": "Claude Code",
   "role": "attacker"
  }
 ],
 "related_agents": [
  "anthropic-claude-code"
 ],
 "vendor_response": "ConnectWise said the activity describes a campaign reaching well beyond any one company, temporarily shut down services after the attacks, and is restoring them in phases over several days. Microsoft disclosed the findings, and Wiz, Recorded Future and Zscaler published follow-up analyses.",
 "sources": [
  {
   "title": "China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack",
   "url": "https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html",
   "outlet": "The Hacker News",
   "date": "2026-10-22"
  }
 ],
 "reviewer": "model: claude-sonnet-5-5 (automated review)",
 "checked_on": "2026-10-25"
}