# China-Linked Group Used ARTEX AI Agents in ConnectWise Cloud Backup Attack, Researchers Say

*Thursday, October 22, 2026 at 6:13 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-22T06:13:25.109Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/21203.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A China-linked hacking group tracked as Storm-0940 used ARTEX AI agents and stolen ConnectWise Cloud Backup credentials to gain access to customer cloud environments, according to Microsoft and security researchers.

A China-linked hacking group turned a widely used backup product into an entry point to customer cloud environments, using AI agents to automate parts of the intrusion, according to new technical reporting.

Microsoft has tied the activity to a threat actor it tracks as Storm-0940. Researchers say the group abused stolen credentials for the ConnectWise Cloud Backup application, which is deployed by managed service providers and enterprises to protect critical data.

By using valid ConnectWise Cloud Backup credentials, Storm-0940 could reach into multiple customer environments that trusted the service. Once inside, the attackers reportedly deployed ARTEX AI agents. These software agents are designed to mimic aspects of user behaviour and decision-making, allowing them to move around a victim’s systems, identify valuable data, and help maintain access.

Turning a backup platform into a foothold inside production and disaster-recovery infrastructure gives attackers wide visibility. It can also undermine confidence in the integrity of backups themselves, since a system meant to recover from incidents becomes a possible channel for tampering.

Researchers say the use of ARTEX AI agents shows how offensive operators are folding AI into live espionage operations, rather than keeping it in the realm of experimentation. Once Storm-0940 had valid credentials, AI-driven tools could map out which cloud services were in use and decide which accounts or data stores to explore next.

Microsoft has attributed the campaign to a China-linked group, placing it in a broader pattern of cyber operations associated with Beijing that focus on information-gathering and long-term access. Chinese officials have consistently denied sponsoring such hacking campaigns.

The compromise of ConnectWise Cloud Backup credentials illustrates how supply-chain style intrusions can cascade from one vendor into many customer networks. Organisations that rely on remote management and backup tools face the challenge of monitoring for malicious use of software that normally has deep, legitimate access.

Signals to watch now include any disclosures from ConnectWise about the number and type of affected customers, regulatory questions from data protection or financial authorities, and reports of similar AI-assisted activity against other remote management or backup products. Patterns in the victim set could clarify whether Storm-0940 is targeting particular sectors or data types.