ARTEX

China-Linked Hackers Deploy ARTEX AI Agents in ConnectWise Supply Chain Compromise

Microsoft has disclosed that the China state-aligned threat actor Storm-0940 compromised the ConnectWise Cloud Backup application via a supply chain attack. During the incident, the actors leveraged ARTEX, a Go-based agentic AI penetration testing framework, to accelerate scanning and enumeration activities. The ARTEX framework, which was made closed-source following its abuse against South Korean financial institutions, was used to speed up reconnaissance within the compromised environment. The full extent of data accessed and the precise scope of exploitation remain under investigation.