Microsoft said Storm-0940, a Chinese state-aligned hacking group, compromised IT services firm ConnectWise. The attackers used a new AI-driven penetration-testing tool called ARTEX to automate and accelerate a campaign that has targeted hundreds of organizations since September 2026.
The supply-chain attack targeted ConnectWise’s Cloud Backup application. The hackers abused application credentials to access downstream victims’ Microsoft 365 environments.
Targets span defense, technology, financial services and government. Microsoft said ARTEX enabled the hackers to operate at “machine speed,” rapidly scaling the attack.