Storm-0940 Uses ARTEX AI Agents in ConnectWise Supply Chain Attack

# Storm-0940 Uses ARTEX AI Agents in ConnectWise Supply Chain Attack

https://gcdradar.vercel.app/incidents/storm-0940-uses-artex-ai-agents-in-connectwise-supply-chain · AIR-2026-1467 · closed 2026-11-09

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation)
- Fix status: No fix needed
- First reported: 2026-10-15 (happened 2026-10-22)
- AI role: AI-enabled attack
- Products: ARTEX, ConnectWise Cloud Backup

## Summary

A China-linked threat actor group utilized an agentic AI penetration testing framework named ARTEX during a supply chain attack against ConnectWise Cloud Backup. The tool was abused to accelerate operations against targeted organizations.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-10-26: South Korean police identify suspects behind ARTEX AI attacks stealing 8.2 million records across 90 organizations (https://bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records)
- 2026-10-22: Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack (https://darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack)
- 2026-10-22: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack (https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html)

## Sources

- 2026-10-15 AI Incident Database: ARTEX AI Agents Reportedly Used Stolen Cloud Backup Credentials to Access ConnectWise Customers' Microsoft 365 Environments https://incidentdatabase.ai/cite/1781
- 2026-10-22 The Hacker News: China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html
- 2026-10-22 Dark Reading: Microsoft Links Storm-0940 to ConnectWise Supply Chain Attack https://darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack
- 2026-10-26 BleepingComputer: Former pentester used ARTEX AI to steal 8.2 million data records https://bleepingcomputer.com/news/security/former-pentester-used-artex-ai-to-steal-82-million-data-records

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.