China-Linked Group Uses AI Tool to Attack Organisations Through ConnectWise Cloud Backup Compromise

Microsoft has disclosed that a China state-aligned group it tracks as Storm-0940 was behind the recent supply chain compromise of the ConnectWise Cloud Backup application. During the incident, the group used ARTEX, an AI-driven penetration testing framework written in Go, to speed up scanning and reconnaissance, password spraying and the abuse of OAuth applications at downstream victims. ARTEX was reportedly made closed-source after it was abused against South Korean financial institutions.

Microsoft said the actor worked at "machine speed" and targeted hundreds of organisations worldwide since September 2026. The sectors affected include aerospace and defence, automotive, energy, financial services, government, legal, manufacturing, software and technology, as well as think tanks and non-profits. The attackers abused applications that had already been granted access, which let them authenticate to target environments without an interactive user sign-in. Follow-on activity included reconnaissance, changes to application credentials and attempts to modify privileges to gain wider or longer-lasting access.

Microsoft first detailed Storm-0940 in November 2024, when it linked the group to a botnet called Quad7 used for evasive password spraying. The group is assessed to be active since at least 2021, and is known to exploit internet-facing applications and add credentials to existing OAuth applications to keep access to Microsoft 365 resources. In several cases, the time from initial targeting to privileged cloud access was under three hours.