Key facts
- Hackers used an AI-driven tool called ARTEX to compromise ConnectWise.
- The campaign targeted hundreds of organizations across various sectors.
- The group achieved privileged cloud persistence at many organizations.
A Chinese-linked hacking group, tracked as Storm-0940, used an AI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a global campaign targeting hundreds of organizations, Microsoft said on Wednesday, October 21, 2026. The hackers utilized an open-source framework called ARTEX, which can leverage AI models to automate tasks like reconnaissance and data exfiltration. While the majority of targeting attempts were unsuccessful, the group managed to achieve privileged cloud persistence at many organizations quickly. ConnectWise had previously stated it was investigating unauthorized access attempts related to its Cloud Backup environment.