Microsoft Links China-Linked Storm-0940 to ConnectWise Cloud Backup AI Attack

Microsoft has attributed a supply chain compromise of the ConnectWise Cloud Backup application to a China-linked threat actor known as Storm-0940. The incident is notable for the attacker’s use of ARTEX, an agentic AI penetration testing framework designed to accelerate the scanning and exploitation of targets.

The breach involved the unauthorised access of the ConnectWise Cloud Backup environment, allowing the state-aligned actor to pivot into downstream customer systems. Microsoft disclosed the findings on 22 October 2026, highlighting an evolving trend where malicious actors leverage artificial intelligence to increase the speed and scale of their operations.

AI Agents Used to Accelerate Attacks

According to researchers at Microsoft, Storm-0940 utilised ARTEX, a Go-based framework that functions as an “agentic” AI. Unlike traditional automated scanners, agentic AI can make autonomous decisions about which vulnerabilities to pursue and how to navigate a compromised network with minimal human intervention.

ARTEX was originally developed as an open-source project but was reportedly made closed-source following its abuse in previous attacks targeting financial institutions in South Korea. The framework’s ability to automate complex reconnaissance and penetration testing tasks makes it a potent tool for state-sponsored actors seeking to maintain persistence and move laterally within enterprise environments.

Storm-0940 and the Supply Chain Vector

Storm-0940 is a state-aligned group with a history of targeting software supply chains to gain access to a broad range of victims. By compromising a trusted service provider like ConnectWise, the attackers can bypass traditional perimeter defences of individual organisations and gain access to high-value data repositories.

In this latest incident, the group focused on the Cloud Backup application, a critical piece of infrastructure that often holds elevated administrative permissions. Microsoft noted that the use of AI agents allowed the attackers to identify misconfigurations and unpatched flaws much faster than manual methods would permit, significantly reducing the dwell time required for a successful intrusion.

ConnectWise has moved to address the vulnerabilities exploited during the compromise. Organisations using the Cloud Backup platform are advised to review their audit logs for any signs of unusual activity and ensure that all current security patches have been applied. Microsoft continues to monitor the activities of Storm-0940 as the group refines its AI-driven methodologies for future campaigns.