State‑Sponsored Chinese Group Leverages AI Pentesting Tool Artex in Widespread ConnectWise Intrusions

A covert hacking operation linked to a Chinese state‑backed group has been identified exploiting the ConnectWise remote‑access platform, using an artificial‑intelligence driven penetration‑testing utility known as Artex. Security researchers say the campaign has infiltrated hundreds of organizations across multiple sectors, with some victims seeing attackers secure elevated privileges inside their networks.

The intrusion chain begins with compromised credentials or phishing attempts that grant the adversaries initial footholds. Once inside, the group deploys Artex, a tool originally designed to automate vulnerability discovery, to scan internal systems and locate exploitable weaknesses. The AI component accelerates the process, allowing the attackers to prioritize high‑value assets and move laterally with speed.

ConnectWise, a popular suite for managed‑service providers, became an attractive target because it offers remote control and ticketing capabilities that, if abused, provide direct pathways to client environments. By hijacking legitimate ConnectWise accounts, the threat actors could masquerade as trusted administrators, bypassing many traditional security controls that rely on identity verification.

Analysts note that the use of an AI‑enhanced pentest tool marks a notable evolution in the tactics of nation‑state actors. Whereas previous campaigns relied heavily on manual scripting and known exploits, the integration of machine‑learning models enables rapid adaptation to diverse network configurations. This shift not only increases the efficiency of the intrusion but also raises the bar for defenders who must now contend with automated discovery mechanisms.

The campaign’s impact is still being quantified, but early indications suggest that several compromised entities have experienced data exfiltration and the deployment of additional backdoors. Security firms advise organizations that employ ConnectWise to audit all remote‑access accounts, enforce multi‑factor authentication, and monitor for anomalous activity such as unexpected privilege escalations or the presence of unfamiliar scanning tools.

Going forward, experts expect that the attackers may refine Artex further, potentially incorporating more sophisticated evasion techniques. The incident underscores the broader challenge of securing supply‑chain and third‑party management solutions, where a single compromised service can cascade across dozens of downstream customers. Vigilance, timely patching, and robust zero‑trust architectures remain essential defenses against such AI‑augmented threats.