China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft disclosed that the China state-aligned actor Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework, in the compromise of the ConnectWise Cloud Backup application. The agents automated scanning, password spraying and abuse of OAuth applications at downstream victims. After gaining control of the identities of multiple ConnectWise cloud applications, they authenticated to customer environments, and in some cases carried out Microsoft Graph and directory operations such as credential changes and privilege-related modifications. Other threat actors were also reported to be using ARTEX.

Export STIX 2.1 Export JSON Request a correction (GitHub issue)

Timeline

2026-08-17 Recorded Future saw activity linked to TAG-217 testing remote access infrastructure and conducting internet scanning. · The Hacker News

2026-09 Storm-0940 began ARTEX-driven attacks on hundreds of organizations, per Microsoft. · The Hacker News

2026-10-10 An automated cross-tenant password-spray campaign began against 327 accounts at eight organizations, running through October 14. · The Hacker News

2026-10-11 Failed logons peaked at 2,900 per minute, with over 111,000 failures that day. · The Hacker News

2026-10-15 The AI agents gained access to the identities of multiple ConnectWise cloud applications and used them to authenticate to customer environments. · The Hacker News

2026-10-22 Microsoft disclosed Storm-0940 as behind the ConnectWise Cloud Backup compromise. · The Hacker News

2026-10-23 Wiz follow-up analysis reported Storm-0940 expanding attempted supply chain compromises into other software sectors. · The Hacker News

Sources · 1

China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack — The Hacker News, 2026-10-22

Links re-checked 2026-10-26 by the weekly refresh. A link that moved or stopped answering is flagged above; it is not a change to the record.

At a glance · as reported

Window	September 2026 - October 2026
Attacker	Storm-0940, a China state-aligned threat actor, using AI agents built on the ARTEX framework; ARTEX was also used by other actors, including the cluster Recorded Future tracks as TAG-217
Scale	Hundreds of organizations targeted since September 2026; attempted sign-ins to more than 2,250 tenants at up to 2,900 per minute; a password-spray campaign against 327 accounts at eight organizations from October 10 to 14, 2026, with over 151,000 failed logons (more than 111,000 on October 11); in some cases privileged access was reached in under 3 hours; Wiz observed sessions lasting 24-30 hours
Impact	The agents gained control of multiple ConnectWise cloud application identities and used them to access customer environments, and a portion of attacks resulted in privileged access to cloud infrastructure. They also modified application credentials in ways that could persist as a backdoor. ConnectWise temporarily shut down services and is restoring them in phases.
Defender	ConnectWise and its downstream customer organizations across many sectors, including aerospace and defense, energy, financial services, government and technology
Response	ConnectWise said the activity describes a campaign reaching well beyond any one company, temporarily shut down services after the attacks, and is restoring them in phases over several days. Microsoft disclosed the findings, and Wiz, Recorded Future and Zscaler published follow-up analyses.

Tactics (MITRE ATT&CK)

TA0001 Initial Access
TA0003 Persistence
TA0004 Privilege Escalation
TA0006 Credential Access
TA0007 Discovery
TA0043 Reconnaissance

Mapped by the maintainer from the reports.

Models and agents named

DeepSeek — attacker

GLM — attacker

Grok — attacker

Claude Code — attacker

Claude Code — in the catalog

Published by the weekly machine review (claude-sonnet-5-5 (automated review)) from the sources above on 2026-10-25: every field is as the sources state it, or empty. Compiled from the public sources above, as reported. Not an attribution, a finding of fault or a legal conclusion; figures are those stated by the sources. One event, as of its sources' dates.