---
title: "China-linked group used agentic AI in ConnectWise breach"
slug: "china-linked-group-used-agentic-ai-in-connectwise-breach"
published: "2026-10-28"
beat: "Crime"
tags: ["Crime", "Research"]
creator: "Agentry Newsroom"
editor: "Susanne Sperling, Editor — Human in the Loop"
tools: ["Claude (Anthropic)", "Perplexity Sonar"]
creativeWorkStatus: "verified"
dateReviewed: "2026-10-28"
aiActArticle50: "compliant"
humanView: "https://agentry.news/crime/china-linked-group-used-agentic-ai-in-connectwise-breach"
agentView: "https://agentry.news/agent/china-linked-group-used-agentic-ai-in-connectwise-breach"
---# China-linked group used agentic AI in ConnectWise breach

> Microsoft reported October 21, 2026, that the China-aligned hacking group Storm-0940 deployed ARTEX, an open-source agentic AI penetration-testing framework, to automate attacks across hundreds of org

*Drafted by an AI agent. Verified by Susanne Sperling, Editor — Human in the Loop. [AI policy](/ai-policy).*

Microsoft attributed a major cyberattack campaign to the China-aligned hacking group Storm-0940, which used **ARTEX**—an open-source agentic penetration-testing framework—to automate offensive-security workflows including reconnaissance and data exfiltration [Microsoft](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/).

## Agent-Driven Attack Automation

ARTEX is designed to use any AI model to orchestrate attack chains autonomously. In this campaign, Storm-0940 leveraged the framework to accelerate the pace of compromise, according to Microsoft's October 21 threat report [Reuters](https://www.reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21/). Microsoft stated that "Storm-0940's use of ARTEX accelerated the speed of compromised application abuse to authenticate to Microsoft 365 customer environments through applications that had already been granted access."

The framework's ability to automate credential-testing and enumeration workflows meant attackers could execute authentication attempts at machine speed rather than human pace—a critical advantage in supply-chain exploitation scenarios where legitimate application credentials provide initial footholds.

## ConnectWise Supply-Chain Compromise

Microsoft assessed that Storm-0940 was responsible for compromising ConnectWise's Cloud Backup service, a managed-services tool widely deployed across enterprises [The Register](https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687). Attackers then weaponized stolen ConnectWise application credentials to attempt authentication against Microsoft 365 tenant environments. In total, Storm-0940 used the compromised credentials to launch **more than 2,250 authentication attempts** against Microsoft 365 customer tenants [CRN](https://www.crn.com/news/security/2026/china-state-aligned-group-storm-0940-used-agentic-ai-at-rate-of-2-900-sign-in-attempts-per-minute-in-connectwise-breach).

The campaign targeted **hundreds of organizations worldwide** across multiple sectors, though Microsoft's published materials do not detail specific victim counts or confirmed successful compromises by organization [Business Standard](https://www.business-standard.com/technology/artificial-intelligence/chinese-linked-hackers-use-ai-to-compromise-firms-globally-microsoft-126102200170_1.html).

## Implications for Agent-Driven Threats

The case demonstrates how agentic frameworks designed for legitimate penetration testing can be repurposed for large-scale offensive operations when paired with supply-chain access and stolen credentials. ARTEX's openness—its ability to orchestrate any AI model into attack workflows—lowered the barrier to automating reconnaissance and authentication-brute-force tasks that would otherwise require manual labor or custom scripting.

The incident underscores a growing risk: as agent frameworks become more accessible and capable, threat actors gain tools to operationalize attacks at greater velocity and scale.