China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Summary

The supplied reporting describes an observed supply-chain campaign attributed by Microsoft to Storm-0940, a China state-aligned actor. According to The Hacker News, the actor compromised identities associated with ConnectWise Cloud Backup applications and used ARTEX, an agentic AI penetration-testing framework, to accelerate reconnaissance, password spraying, and downstream application abuse. The broader campaign reportedly targeted hundreds of organizations worldwide across government, defense, financial services, technology, manufacturing, and other sectors since September 2026.^[0]

The evidence distinguishes an unsuccessful password-spray interval from subsequent application-credential abuse. Between October 10 and 14, infrastructure at 144.172.64.99 reportedly generated more than 151,000 failed logons against 327 accounts across eight organizations, without detected successful authentication, token issuance, Graph calls, or directory changes. On October 15, agents reportedly gained control of multiple ConnectWise cloud application identities and began authenticating to customer environments with stolen application credentials. The reporting does not establish that the earlier spray obtained those credentials.^[0]

The central downstream mechanism was abuse of existing application trust: compromised applications already had access to customer tenants, allowing authentication without an interactive user sign-in. Some activity reportedly progressed to Microsoft Graph and directory operations, including application credential changes and changes involving identities, groups, and privileged roles. These changes could create persistence beyond the originally compromised application. More than 2,250 tenants were reportedly targeted for sign-in attempts; that number should not be interpreted as confirmed tenant compromises.^[0]

The core ConnectWise attribution, telemetry, and response details are supported only by the supplied aggregator article, which quotes Microsoft and ConnectWise; their underlying reports are not supplied as evidence bodies. The additional Recorded Future excerpt concerns TAG-217 and South Korean financial-sector attacks, not independent verification of the ConnectWise incident. ARTEX use alone therefore does not establish a connection between Storm-0940 and TAG-217. ConnectWise reportedly suspended services temporarily and was restoring them in phases at the time of reporting.^[0][13]

Attack chain

1. 1. Observed password spraying without detected success: Between October 10 and 14, 2026, infrastructure at 144.172.64.99 conducted automated cross-tenant password spraying against 327 accounts in eight organizations to seek Microsoft 365 and Exchange Online access. More than 151,000 failed logons were reported. No successful authentication, token issuance, Graph call, or directory change was detected in this interval, so it is not an established successful initial-access path.^[0]
2. 2. Control of ConnectWise application identities: On October 15, the agents reportedly gained access to identities associated with multiple ConnectWise cloud applications. The subsequent activity used stolen application credentials. The supplied reporting does not explain how those credentials were acquired or demonstrate a causal link to the earlier password spray.^[0]
3. 3. Authentication through downstream application trust: The agents used the compromised application credentials to authenticate to customer environments through permissions and trust already granted to those applications. This allowed access without an interactive user sign-in. The reporting says the agents continued using the same IP range, but does not specify that range.^[0]
4. 4. Post-authentication reconnaissance and persistence-related changes: In some environments, activity reportedly progressed to Microsoft Graph and directory operations. Observed or assessed actions included reconnaissance, application credential modifications intended to establish persistence, and changes involving identities, groups, and privileged roles. The reporting warns that resulting access paths can survive remediation of the originally compromised application.^[0]

Disclosure timeline

Actor profile

Storm-0940

Microsoft, as quoted by The Hacker News, identifies Storm-0940 as a China state-aligned actor responsible for the ConnectWise Cloud Backup supply-chain compromise. The actor is assessed to have been active since at least 2021. Historical activity described in the article includes evasive password spraying using Quad7 infrastructure, exploitation of internet-facing applications, movement through environments using compromised accounts, and persistence through credentials added to existing OAuth applications. Microsoft reportedly first detailed the actor in November 2024. These historical techniques provide context but are not all demonstrated as steps in the supplied ConnectWise incident narrative.^[0]

How it works

The concrete exploitation mechanism described here is cloud application identity abuse rather than a documented version-specific software vulnerability. After obtaining credentials for multiple ConnectWise cloud applications, the agents authenticated through access those applications had already been granted in customer tenants. Existing application trust enabled non-interactive access; the supplied reporting does not identify the original credential-acquisition mechanism.^[0]

The persistence risk extends beyond the initial application identity. Microsoft reportedly observed application credential modifications and activity involving identities, groups, and privileged roles. Added or altered credentials can establish other access paths that remain usable after the originally compromised application is remediated. The article describes this as a potential residual backdoor, not proof that every targeted tenant received persistent access.^[0]

ARTEX served as an automation and acceleration layer for reconnaissance, password spraying, and application abuse. The article describes it as a Go-based agentic penetration-testing framework. Microsoft reportedly observed several broader Storm-0940 ARTEX attacks reaching privileged cloud access in less than three hours, but the supplied evidence does not establish that timing for every ConnectWise-related intrusion or identify a new AI-specific vulnerability.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• Treat failed password spraying and subsequent application-credential abuse as separate observations. The supplied evidence does not establish that the spray succeeded or explain how the ConnectWise application credentials were obtained.^[0]
• Existing application trust was the downstream access mechanism. Investigation and containment must account for non-interactive identities and persistence-related directory changes, not only interactive user authentication or the originally compromised application.^[0]
• Keep targeting, authentication, and compromise metrics distinct: more than 2,250 tenants were reportedly targeted, while the 327-account, eight-organization spray interval had no detected successful authentication.^[0]
• ARTEX is not an attribution marker by itself. The supplied sources describe its use by Storm-0940 and by TAG-217, but do not establish that these names identify the same actor or a coordinated operation.^[0][13]
• The ConnectWise findings remain single-source within this evidence set. Recorded Future supplies additional context about ARTEX-enabled operations and TAG-217, but does not independently substantiate the ConnectWise attribution, telemetry, or remediation status.^[0][13]

Defensive actions

• Hunt authentication records for 144.172.64.99, prioritizing October 10–14, 2026, and correlate failures across targeted accounts and organizations.: This address is explicitly associated with the reported spray. Its high-volume failures provide a concrete historical detection opportunity, but the absence of successful logons in that interval means those failures alone should not be labeled confirmed compromise.^[0]
• Review non-interactive application authentication associated with ConnectWise integrations, particularly activity beginning October 15, and correlate it with subsequent Microsoft Graph and directory operations.: The reported successful downstream access used stolen application credentials and existing tenant trust rather than interactive user sign-ins. Reviewing only user-login activity would omit the access mechanism described in this incident.^[0]
• Audit application credential additions and modifications together with changes to identities, groups, and privileged roles in potentially affected tenants.: These are the specific post-authentication operations described in the reporting. Reviewing them together can help distinguish authentication attempts from activity that established additional access or changed privileges.^[0]
• During containment, remove unauthorized application credentials and investigate secondary access paths rather than treating remediation of the original ConnectWise application as sufficient.: Microsoft reportedly warned that credential changes could preserve access through other identities, credentials, or cloud services after the originally compromised application had been remediated.^[0]
• Prioritize rapid triage when suspicious application authentication is followed by credential or privilege changes.: The article reports machine-speed automation and several broader Storm-0940 ARTEX attacks that progressed from initial targeting to privileged cloud access in less than three hours. This supports prioritizing the described sequence without assuming every ConnectWise incident followed that exact timetable.^[0]