China APT Uses AI Pentest Tool Artex in ConnectWise Attacks
A China-linked threat actor has been using the open source AI penetration testing framework Artex to automate a recent ConnectWise hacking campaign targeting hundreds of organizations, Microsoft reports.
Tracked as Storm-0940 and active since at least 2021, the APT is known for relying on password spraying and the exploitation of vulnerable internet-facing applications to hack into organizations across multiple sectors.
Starting in early September 2026, the threat actor was seen abusing Artex to automate its attacks, and previous reporting by CrowdStrike, Zscaler, and Recorded Future linked this AI-powered activity to attacks targeting South Korean financial institutions.
Now, Microsoft says Storm-0940 used Artex to automate intrusions into ConnectWise customers’ environments in mid-October. In response, ConnectWise suspended several services, including Cloud Backup, SaaS Security, and Cloud Management.
At the time, Huntress observed the attackers using compromised ConnectWise application credentials to access hundreds of Microsoft 365 tenants, including over 300...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
