China-Linked Hackers Use ARTEX AI Agents in ConnectWise Supply Chain Attack

Microsoft disclosed that China state-aligned threat actor Storm-0940 was responsible for a supply chain compromise targeting the ConnectWise Cloud Backup application. The attackers leveraged ARTEX, a Go-based agentic AI penetration testing framework, to accelerate scanning operations during the attack. ARTEX was previously made closed-source following its abuse against South Korean financial institutions. The incident represents a notable use of AI-powered offensive tooling by a nation-state actor. This supply chain attack highlights the growing sophistication of Chinese state-sponsored cyber operations and their adoption of advanced AI-driven frameworks to enhance attack efficiency.