China Hackers Use ARTEX AI in ConnectWise Supply Chain Attack

Introduction

Microsoft has disclosed a sophisticated supply chain attack targeting the ConnectWise Cloud Backup application, attributing the operation to a China state-aligned threat actor tracked as Storm-0940. What makes this incident particularly concerning is the use of ARTEX, a Go-based agentic AI penetration testing framework, which was reportedly employed to automate and accelerate key stages of the intrusion. This marks a notable evolution in how nation-state actors are leveraging AI tooling to enhance their operational capabilities in real-time attack scenarios.

Storm-0940 and the Use of ARTEX

Storm-0940 is a known China state-aligned group that has been active in targeting organizations across multiple sectors, particularly those in technology and critical infrastructure. In this latest campaign, the group was observed deploying ARTEX, an AI-powered penetration testing framework originally designed for legitimate security assessments. ARTEX is built using the Go programming language and is capable of autonomously executing tasks such as vulnerability scanning, lateral movement, and data exfiltration. Microsoft noted that the framework’s agentic nature allowed Storm-0940 to reduce manual intervention during the attack lifecycle, thereby increasing both speed and scale.

Supply Chain Compromise via ConnectWise

The attack centered on the ConnectWise Cloud Backup application, a widely used solution among managed service providers (MSPs) and enterprise IT teams. By compromising the software supply chain, Storm-0940 was able to inject malicious code into legitimate updates, potentially affecting a broad base of downstream users. This method of infiltration allows attackers to bypass traditional perimeter defenses and gain initial access through trusted vendor relationships. While the full scope of impacted organizations has not yet been disclosed, the nature of the compromise suggests potential exposure across multiple industries relying on ConnectWise infrastructure.

AI as a Force Multiplier in Cyberattacks

The integration of ARTEX into this operation underscores a growing trend where adversarial groups are adopting AI-driven tools to augment their attack methodologies. Unlike conventional malware that requires direct human oversight, agentic AI frameworks can adapt dynamically to defensive measures, making them harder to detect and neutralize. Microsoft emphasized that while ARTEX was previously associated with attacks on South Korean financial institutions, its application in this context represents a shift toward more autonomous and scalable intrusion techniques. Security teams must now consider how AI can be weaponized not only in reconnaissance but also in execution phases of an attack.

What Organizations Should Do Now

Organizations utilizing ConnectWise Cloud Backup or similar third-party services should immediately audit their environments for signs of compromise, including unauthorized access tokens, unexpected network traffic, and anomalous file modifications. It is also advisable to implement strict software integrity checks, enforce multi-factor authentication on all administrative accounts, and monitor for unusual behavior patterns that may indicate AI-assisted activity. Vendors should enhance their code-signing processes and adopt zero-trust principles to limit lateral movement in the event of a breach. Additionally, defenders should update their threat intelligence feeds to include indicators related to ARTEX and Storm-0940.

Conclusion

The ConnectWise supply chain attack orchestrated by Storm-0940 using ARTEX signals a new frontier in AI-enabled cyber operations. As threat actors continue to adopt and adapt AI frameworks for malicious purposes, defenders must evolve their strategies accordingly. Proactive monitoring, robust vendor risk management, and intelligent automation will be essential in mitigating future incidents. Grivyonx Technologies supports organizations in strengthening their DevSecOps and cloud security postures through AI-powered automation designed to anticipate and counteract evolving threats.