China-Linked Hackers Deploy ARTEX AI in Supply Chain Breach
State-backed attackers used an AI-powered tool to exploit ConnectWise's cloud backup service. The breach highlights growing risks from adversarial AI in supply chains.
TL;DR
- Storm-0940, a China-linked APT group, compromised ConnectWise Cloud Backup via a supply chain attack.
- Attackers leveraged ARTEX, a closed-source Go-based AI pentesting framework, to accelerate reconnaissance.
- ARTEX was previously used in attacks against South Korean financial institutions.
- Microsoft disclosed the incident, emphasizing the increasing use of AI by threat actors.
- Organizations using ConnectWise services should review access logs and update credentials immediately.
A state-sponsored hacking group linked to China has been identified as the perpetrator behind a recent supply chain compromise targeting ConnectWise's Cloud Backup application. According to Microsoft, the group—tracked as Storm-0940—used an advanced agentic AI framework called ARTEX to automate and expedite their reconnaissance efforts during the breach.
This marks a significant escalation in how adversaries are integrating artificial intelligence into cyberattacks. ARTEX, originally developed for penetration testing, had already been flagged for misuse in earlier intrusions against South Korean financial institutions before being taken private. Its reappearance in this campaign underscores the dual-use nature of emerging offensive security tools.
The Attack Vector
- Storm-0940 gained initial access through the ConnectWise Cloud Backup application, a widely-used managed service provider tool.
- Once inside, the attackers deployed ARTEX—an AI-driven reconnaissance agent written in Go—to map internal networks and identify high-value targets.
- ARTEX enabled rapid scanning and data collection, reducing manual effort typically required in such operations.
Implications for Software Security Teams
- Supply chain threats remain a critical vector, especially when third-party applications have privileged access to enterprise environments.
- Defensive teams must now account for AI-enhanced attacker capabilities that can autonomously adapt and scale malicious activities.
- Organizations should audit vendor integrations, enforce zero-trust principles, and monitor for anomalous behavior indicative of automated tooling like ARTEX.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.