China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

A China-linked hacking group known as Storm-0940 has been identified as the perpetrator of a supply chain attack on the ConnectWise Cloud Backup application. Microsoft disclosed the group's involvement in the recent compromise. The attackers utilized ARTEX, an AI-powered penetration testing framework, to accelerate scanning. ARTEX is a Go-based framework that was previously made closed-source due to its misuse in attacks against South Korean financial institutions. The use of ARTEX in this incident highlights the group's efforts to leverage advanced tools in their attacks. Storm-0940's actions demonstrate the ongoing threat of state-aligned actors to supply chain security.