China-Linked Hackers Deploy ARTEX AI Agents in ConnectWise Supply Chain Compromise

Microsoft researchers announced on Wednesday that a China state-aligned actor identified as Storm-0940 was behind a supply chain compromise of the ConnectWise Cloud Backup application. According to the disclosure, the threat actor exploited the trusted supply chain to gain access to ConnectWise Cloud Backup customers' data and potentially move laterally into connected networks.

In a novel aspect of the attack, Storm-0940 used ARTEX, a Go-based agentic AI penetration testing framework, to accelerate scanning and enumeration tasks within the compromised environment. The ARTEX framework, which incorporates agentic AI capabilities designed for penetration testing, was originally made closed-source in the wake of its abuse against South Korean financial institutions. Microsoft's disclosure notes that the actors leveraged this tool to speed up reconnaissance activities, though the specific capabilities employed in this campaign and the exact extent of data exfiltration are not yet fully detailed.

The compromise represents a significant supply chain risk, as ConnectWise Cloud Backup is a trusted solution used by organizations to protect critical data. By compromising the application itself, the threat actor gained the ability to access backup data from multiple downstream customers. Microsoft and ConnectWise have likely issued security advisories, and affected organizations are being urged to update to the latest versions, monitor for indicators of compromise, and implement network segmentation and strict access controls for backup systems.

The use of AI-enhanced tools in supply chain attacks marks a evolving trend in threat actor tradecraft, automating reconnaissance and increasing the speed of lateral movement. The security community is monitoring the situation for further details regarding the attack timeline, the specific data impacted, and any available patches or mitigations.