# China‑Linked Group Used ARTEX AI Agents and Stolen ConnectWise Credentials in Cloud Intrusions

*Thursday, October 22, 2026 at 6:06 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-22T06:06:44.352Z (3h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/21189.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Security researchers say a China‑linked group tracked as Storm‑0940 used ARTEX AI agents and stolen credentials for ConnectWise Cloud Backup to break into customer cloud environments in a supply‑chain style attack.

A hacking group linked to China used artificial‑intelligence tools and stolen credentials for a popular backup product to gain access to multiple cloud environments, according to new technical reporting.

The group, tracked by Microsoft as Storm‑0940, abused credentials for the ConnectWise Cloud Backup application to access customer systems, The Hacker News reported on 22 October. Because the attackers came in through a trusted backup platform, researchers describe the incident as a supply‑chain compromise affecting downstream users of the service.

Investigators say Storm‑0940 made use of ARTEX AI agents while operating inside victim environments. These AI components helped automate parts of the intrusion, such as reconnaissance and adapting to different network setups, rather than relying solely on scripts and manual commands.

ConnectWise Cloud Backup is widely used by managed service providers and enterprises to store off‑site copies of critical data. By stealing or otherwise obtaining valid credentials, Storm‑0940 was able to pose as an authorized user and work within the same systems companies rely on to recover from outages or ransomware.

This approach turns a core defensive tool into a point of entry. Backup systems typically contain detailed information about an organization’s infrastructure, including configuration data and full snapshots of servers and user files. If attackers can read or alter those backups, they have both a map of the network and leverage over an organization’s last resort for recovery.

The AI angle matters because it lets a relatively small team of operators move faster through complex environments. An AI agent can sift through logs and system data and suggest next steps at speed, shortening the time between initial access and deeper compromise.

For organizations that depend on third‑party IT and backup services, the Storm‑0940 campaign shows how supply‑chain access and AI‑driven tooling are starting to intersect. A compromise of a single cloud backup platform can ripple across many customers if attackers are able to reuse access paths and tools.

Signals to watch include how many end‑customer environments ConnectWise and Microsoft ultimately link to this activity, whether regulators push for tighter security and transparency rules for backup providers, and whether similar ARTEX‑style AI components appear in other intrusion campaigns attributed to China‑linked groups.