What we know

Microsoft reported that a China-aligned hacking group known as Storm-0940 used AI agents in a supply chain attack on ConnectWise Cloud Backup. The attackers employed the ARTEX AI agent framework to automate their efforts. This campaign involved attempted sign-ins at more than 2,250 organizations, indicating a wide-reaching operation. The threat actor Storm-0940 is linked to China and used AI-driven tools in the attack. The ARTEX AI agent framework facilitated the automated sign-in attempts. Over 2,250 organizations were targeted through the ConnectWise Cloud Backup supply chain.

Why it matters

Supply chain attacks can compromise numerous organizations by exploiting trusted third-party vendors, making them particularly dangerous. ConnectWise provides widely used IT management software, so an attack on its Cloud Backup service could have broad impact. The involvement of AI agents like ARTEX suggests attackers are adopting more advanced, scalable methods to increase the effectiveness and reach of cyberattacks.

What is still unknown

Details about the accuracy and effectiveness of the AI agents remain unclear. The languages supported by the ARTEX framework and whether it has been used in other attacks are not specified. No information is available on any patches or mitigations released by ConnectWise or other affected parties. Independent verification of the attack’s scope and the AI tools’ capabilities has not been reported.