Microsoft says a China-state aligned actor it tracks as Storm-0940 compromised the ConnectWise Cloud Backup application in a supply-chain attack, using ARTEX—an AI-assisted, agentic penetration testing framework—to speed up parts of the intrusion.
Microsoft’s disclosure describes the framework as Go-based and notes ARTEX was later closed-source after reported abuse against financial institutions in South Korea. Across outlets, the shared reporting is that Storm-0940 used ARTEX to run the campaign, with Microsoft attributing the activity to a China-linked threat group.
Coverage differs mainly in emphasis and the amount of operational detail. CyberScoop highlights quantitative activity figures from Microsoft researchers about tenant reach and sign-in attempts per minute, while Hacker News focuses more on the use of ARTEX in the ConnectWise supply-chain context. Rappler similarly centers on the compromise and the use of ARTEX, framing it as a global attack targeting hundreds of victims.
