# China-linked hackers use ARTEX AI agents in ConnectWise Cloud Backup intrusion, researchers say

*Thursday, October 22, 2026 at 6:19 AM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-22T06:19:42.983Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 8/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/21215.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: A China-linked group tracked as Storm‑0940 used ARTEX AI agents and stolen ConnectWise Cloud Backup credentials to enter customer cloud environments in a supply‑chain attack, according to new research.

A China-linked hacking group has been accused of using artificial intelligence tools to deepen a supply‑chain attack on cloud customers.

Security researchers say the attackers used ARTEX AI agents together with stolen ConnectWise application credentials to gain access to multiple customer cloud environments. The intrusions centred on ConnectWise Cloud Backup, which many managed service providers use to protect client data.

Microsoft has tied the activity to a threat actor it tracks as Storm‑0940 and linked it to the ConnectWise Cloud Backup supply‑chain compromise. By abusing trust in the backup service and its credentials, the group was able to move from ConnectWise-managed systems into end‑customer environments.

Investigators report that ARTEX AI agents were used to support the operation inside victim networks. The agents helped the attackers sift data and coordinate steps in the intrusion across different environments.

For organisations that rely on managed service providers, the case underlines how a compromise in a widely used cloud backup platform can expose many downstream customers at once.

Key points to watch are how ConnectWise and its partners describe the scope of the breach, whether any major sectors report follow‑on incidents linked to Storm‑0940, and what guidance security vendors issue on detecting similar AI‑assisted campaigns.