China aligned group Storm 0940 uses AI tool in ConnectWise breach

Microsoft disclosed that a China-state aligned group tracked as Storm-0940 carried out a supply chain attack against ConnectWise Cloud Backup applications, according to Dark Reading and The Hacker News. Dark Reading and CyberSecurityNews reported that the group used an automated AI tool to target between 2,200 and 2,250 tenants. [1][2][5][6]

The Hacker News, InfoSecurity Magazine, and Security Affairs reported that the hackers utilized ARTEX, a Go-based agentic AI penetration testing framework, to execute the attacks. InfoSecurity Magazine noted that the group targeted hundreds of organizations globally across multiple industries starting in September 2026. The compromise forced ConnectWise to take several cloud services offline after obtaining elevated privileges. [2][4][7][8]

The ARTEX framework was made closed-source following its deployment in the attack, according to The Hacker News. Dark Reading and SC Media reported that the AI tools allowed the hackers to automate and accelerate their intrusion activities across customer environments. [1][2][8]

ConnectWise provides software applications to managed service providers that deliver IT services to business clients. In similar supply chain events, infrastructure software used by service providers has served as an entry point to compromise downstream customer organizations. [4][10]