# China‑Linked Group Used AI Agents in ConnectWise Cloud Backup Supply‑Chain Attack, Researchers Say

*Thursday, October 22, 2026 at 6:15 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-22T06:15:22.016Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 9/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/21208.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Security researchers report that China‑linked hackers used ARTEX AI agents and stolen ConnectWise Cloud Backup credentials to access customer cloud environments in an attack Microsoft ties to threat actor Storm‑0940.

Security researchers say a China‑linked hacking group turned ConnectWise’s Cloud Backup product into a foothold inside customer systems, using AI‑driven tools and stolen credentials in a supply‑chain compromise.

According to reporting cited by The Hacker News, the attackers used ARTEX AI agents together with stolen ConnectWise Cloud Backup credentials to break into customer cloud environments. Microsoft attributes the operation to a threat actor it tracks as Storm‑0940 and links it to the broader ConnectWise Cloud Backup supply‑chain breach.

By abusing the cloud backup service, the group is reported to have gained access through a trusted application rather than attacking each victim directly. Target organisations rely on ConnectWise to safeguard data and maintain continuity, which means the compromised platform already had wide access to customer environments.

The mention of ARTEX AI agents points to the use of automated tools that can help intruders move through networks and data more quickly. For defenders, that raises concern that similar AI‑enabled techniques could become standard in operations attributed to state‑linked groups.

Companies using ConnectWise Cloud Backup will be looking for detailed guidance on what data or systems may have been exposed and how to detect traces of Storm‑0940’s activity. Public technical advisories from ConnectWise and Microsoft, and any follow‑up reports of breaches connected to this campaign, will indicate how far this compromise spread and whether similar AI‑assisted intrusions emerge in other cloud or managed‑service platforms.