A China-linked threat group utilized autonomous artificial intelligence tools to execute a sophisticated supply chain attack targeting IT management and cloud backup provider ConnectWise, according to Microsoft Threat Intelligence. The campaign highlights a significant escalation in the speed and scale of automated cyberattacks.
Storm-0940 Leverages ARTEX AI Agents
Microsoft attributed the campaign to a threat actor tracked as Storm-0940, a group active since at least 2021. In the recent incident, the hackers employed ARTEX—an AI-driven penetration testing framework capable of executing offensive security workflows from reconnaissance to data exfiltration with minimal human intervention.
By leveraging ARTEX, the attackers accelerated the speed of compromised application abuse to authenticate into target environments using applications that had already been granted access. This approach allowed the threat group to operate without requiring interactive user sign-ins. Following the ConnectWise cloud backup service breach—formerly known as SkyKick—the adversary attempted to sign in to more than 2,250 customer tenants at a staggering pace of approximately 2,900 sign-in attempts per minute.
According to Microsoft executive vice president Igor Tsyganskiy, the ConnectWise incident is part of a broader wave of AI-driven attacks observed since early October. While the ARTEX developer took the framework closed-source on October 8 after researchers linked it to attacks on South Korean banks, previously downloaded copies remain in circulation and are being utilized by multiple threat actors globally.
Impact Across Multiple Sectors and Rapid Breach Times
The automated nature of the ARTEX-driven campaign drastically compressed the timeline of compromise. Microsoft reported that several targeted organizations experienced a progression from initial targeting to privileged access to cloud infrastructure in less than three hours.
The campaign impacted hundreds of organizations across a wide range of industries globally, including defense, energy, government, finance, legal, manufacturing, technology, and media services. In some instances, the AI agents altered administrative roles and credentials to maintain persistent access. Security experts note that a successful login does not automatically confirm data exfiltration, but affected environments require thorough independent security reviews.
ConnectWise Response and Ongoing Investigation
ConnectWise CEO Manny Rivelo stated that a China-aligned group appeared to be behind the breach. To mitigate ongoing risks, ConnectWise temporarily paused the affected application connections and initiated a gradual restoration of services.
However, security officials warn that simply severing the vulnerable connections is insufficient if adversaries have already established unauthorized access inside a customer network. Organizations whose environments were potentially exposed are urged to conduct comprehensive system audits to verify administrator credentials and root out any lingering persistence mechanisms left behind by the automated threat actors.
