{
 "type": "bundle",
 "id": "bundle--d1d0a0a5-7d20-5cb5-99f0-c8b565e0a445",
 "objects": [
  {
   "type": "incident",
   "spec_version": "2.1",
   "id": "incident--d724e6f9-c760-5e15-8fc4-2e390f105645",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack",
   "description": "Microsoft disclosed that the China state-aligned actor Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework, in the compromise of the ConnectWise Cloud Backup application. The agents automated scanning, password spraying and abuse of OAuth applications at downstream victims. After gaining control of the identities of multiple ConnectWise cloud applications, they authenticated to customer environments, and in some cases carried out Microsoft Graph and directory operations such as credential changes and privilege-related modifications. Other threat actors were also reported to be using ARTEX.",
   "external_references": [
    {
     "source_name": "AgentDossier",
     "external_id": "TR-2026-026",
     "url": "https://sushegaad.github.io/AgentDossier/traces/tr-2026-026/"
    },
    {
     "source_name": "The Hacker News",
     "url": "https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html",
     "description": "China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack"
    }
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--cc567f41-8c0a-5f0d-8c5e-4f298cd2efb5",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "Storm-0940, a China state-aligned threat actor, using AI agents built on the ARTEX framework; ARTEX was also used by other actors, including the cluster Recorded Future tracks as TAG-217",
   "roles": [
    "attacker"
   ]
  },
  {
   "type": "identity",
   "spec_version": "2.1",
   "id": "identity--d81e77e9-30d2-57e5-90fe-cf59e822ff45",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "ConnectWise and its downstream customer organizations across many sectors, including aerospace and defense, energy, financial services, government and technology",
   "roles": [
    "defender"
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--ead6759d-46de-59dd-9ace-4535669639a5",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "TA0001 Initial Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0001"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--c4c25b39-3436-5b55-9c72-33894c466365",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "TA0003 Persistence",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0003"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--31c4b45d-e58c-584d-b12c-5415a5042825",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "TA0004 Privilege Escalation",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0004"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--0b34ea51-7310-5235-8304-22d1cb302ac5",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "TA0006 Credential Access",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0006"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--7832b7d9-8826-5795-90c2-2f69e0f6bfe5",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "TA0007 Discovery",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0007"
    }
   ]
  },
  {
   "type": "attack-pattern",
   "spec_version": "2.1",
   "id": "attack-pattern--2052cf19-c056-5fb5-8872-a7e98816b725",
   "created": "2026-10-15T00:00:00.000Z",
   "modified": "2026-10-15T00:00:00.000Z",
   "name": "TA0043 Reconnaissance",
   "external_references": [
    {
     "source_name": "mitre-attack",
     "external_id": "TA0043"
    }
   ]
  }
 ]
}