Chinese State-Linked Group Exploits AI Tool in ConnectWise Cloud Backup Supply Chain Breach

Microsoft announced on Wednesday that a cyber‑espionage group with ties to the Chinese government, identified as Storm-0940, was responsible for a recent supply‑chain intrusion affecting ConnectWise's Cloud Backup service. The attackers leveraged a novel Go‑language framework called ARTEX, which automates penetration‑testing techniques through artificial‑intelligence agents, to infiltrate the software development pipeline.

The breach allowed the threat actors to embed malicious code into the ConnectWise backup application before it was distributed to customers. Once installed, the compromised client could grant the intruders remote access to the victim’s network, potentially exposing sensitive data across a range of industries that rely on ConnectWise for managed‑service operations. Microsoft’s security teams detected the activity through telemetry from its Defender platform and quickly notified ConnectWise, prompting an emergency patch and remediation effort.

ARTEX represents a growing class of AI‑driven tools that streamline the reconnaissance and exploitation phases of an attack. Built in the Go programming language, the framework can autonomously generate and test payloads, reducing the manual effort traditionally required by skilled operators. Security researchers have warned that such agentic systems could lower the barrier to entry for sophisticated intrusion techniques, making it easier for nation‑state actors to scale their operations.

ConnectWise, a provider of remote monitoring and management solutions, has been a frequent target for supply‑chain attacks because its software is widely deployed in IT service environments. By compromising a backup utility, the attackers positioned themselves to reach a broad swath of downstream customers, many of whom handle critical infrastructure and confidential client data. The incident underscores the heightened risk associated with third‑party software components and the need for continuous verification of code integrity throughout the development lifecycle.

In response, Microsoft has urged organizations using ConnectWise products to apply the latest updates and to review any anomalous activity in their environments. The company also highlighted ongoing efforts to enhance detection of AI‑augmented threats and to collaborate with industry partners on shared threat intelligence. Analysts predict that the integration of advanced AI tools into malicious toolkits will become more common, prompting a reevaluation of traditional defensive strategies and increased investment in supply‑chain security measures.