China‑linked hackers use ARTEX AI agents in ConnectWise Cloud Backup breach, Microsoft says
Security researchers say China‑linked operators used ARTEX AI agents with stolen ConnectWise Cloud Backup credentials to break into customer cloud environments. Microsoft has tied the group, tracked as Storm‑0940, to a supply‑chain compromise that shows how attackers are pairing AI with trusted IT tools to reach corporate data.
A China‑linked hacking group is accused of turning backup software and artificial intelligence agents into a route into corporate cloud systems, in what analysts describe as a supply‑chain intrusion.
According to security reporting, the attackers used ARTEX AI agents together with stolen credentials from ConnectWise’s Cloud Backup application to gain access to customer cloud environments. The compromise of ConnectWise, a widely used IT tool, meant that the hackers could reach organizations that rely on the service to protect and manage their data.
Microsoft has attributed the activity to a group it tracks as Storm‑0940. The company said this group was responsible for the ConnectWise Cloud Backup supply‑chain compromise, which let the attackers move from the software provider’s environment into networks and cloud systems operated by downstream customers.
ConnectWise’s Cloud Backup sits close to the core of many IT setups, handling backups and related management functions. If attackers obtain valid credentials at that layer, they can often see and manipulate data that organizations consider their last line of defense against outages or ransomware.
The reported use of ARTEX AI agents shows how automation is being built into these kinds of operations. AI agents can be assigned multi‑step tasks, such as scanning for weaknesses, cataloging assets or pulling specific types of data, and can repeat them across many targets. In this case, researchers say the agents helped the hackers carry out reconnaissance and exploitation more efficiently across multiple victim environments.
For affected organizations, the immediate concern is that someone with access to backup credentials may have been able to copy, delete or alter sensitive information. Because backup systems often connect to many parts of a network, they can give intruders a detailed picture of how systems are structured and where valuable data sits.
The incident underlines that supply‑chain security now includes the software and cloud tools used by IT departments, not just hardware makers or operating system vendors. When attackers compromise a provider like ConnectWise, many customer networks can be exposed even if those customers followed security guidance on their own systems.
From a strategic point of view, the case fits into a pattern in which suspected Chinese groups look for access to the connective tissue of digital infrastructure, from telecom gear to management platforms. Long‑term, low‑visibility access can yield intelligence on business plans, technology and government activity.
The role of AI agents in this campaign also gives a glimpse of where offensive cyber operations are heading, with more of the routine work of intrusions handed to automated systems that can execute at scale.
Key developments to track now include any public detail from ConnectWise or its clients on how many organizations were affected, regulatory reactions to another cloud‑focused supply‑chain breach, and steps by major providers to monitor or restrict the use of autonomous AI agents inside sensitive networks.
Sources
- OSINT