China-Linked Hackers Use ARTEX AI Agents in Connect Wise Supply Chain Attack
Summary: Microsoft attributed the ConnectWise Cloud Backup supply chain compromise to Storm-0940, a China state-aligned actor that used the Go-based agentic AI framework ARTEX to automate scanning, password spraying, and OAuth application abuse against hundreds of organizations since September 2026. In the ConnectWise incident, the actor's agents attempted sign-ins to more than 2,250 tenants at up to 2,900 attempts per minute, and on October 15, 2026 gained access to identities of multiple ConnectWise cloud applications and used them to authenticate into customer environments. Microsoft said some ARTEX-driven attacks yielded privileged cloud access in under 3 hours, and that application credential changes can persist as a backdoor after the original compromised application is remediated.
Key Takeaway: Microsoft recorded over 151,000 failed logon events between October 10 and 14, 2026, with no successful authentication - then the agents walked in on October 15 through stolen ConnectWise app credentials that tenants had already trusted. When initial targeting to privileged access can take under 3 hours, the window between exposure and remediation is the control that matters.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026