Microsoft ties ConnectWise supply chain attack to Chinese actor Storm-0940

· Cybersecurity · United States · China

Microsoft attributed the recent supply chain compromise of ConnectWise's Cloud Backup application to a China state-aligned hacking group it calls Storm-0940, according to reports published Wednesday. The actor used ARTEX, a Go-based agentic AI penetration-testing framework that was made closed-source after earlier abuse, to automate and accelerate the intrusion, which affected more than 2,200 tenants. Microsoft said the same techniques are being used to try to compromise organizations around the world. The disclosure shifts the ConnectWise incident from an isolated vendor breach into a broader campaign, and puts automated, AI-driven attack tooling at the center of how state-linked groups are scaling their operations against managed service providers and their downstream customers.

Why it matters：It confirms AI-automated tooling is now standard in state-linked supply chain attacks, raising the pressure on MSPs and the thousands of businesses that depend on their software.

Key points

  • Microsoft named Storm-0940 as the actor behind the ConnectWise Cloud Backup compromise.
  • The ARTEX framework is a Go-based agentic AI penetration-testing tool later made closed-source.
  • More than 2,200 tenants were affected in the attack.

Sources (original reporting)

More stories from this day