ConnectWise Attack Shows How Agentic AI Can Accelerate Cloud Intrusions

Redmond, 22 October 2026 – Microsoft Corporation has attributed a campaign targeting hundreds of organisations through ConnectWise Cloud Backup to Storm-0940, a threat actor it assesses as aligned with China. Microsoft said the group used ARTEX, an open-source agentic penetration-testing framework, to automate parts of the operation across sectors including finance, energy, manufacturing, semiconductors and government.

The campaign matters to Asian businesses because managed-service software can connect one vendor identity to many customer cloud environments. Microsoft’s attribution and description of ARTEX are its assessment rather than an independently established fact. ConnectWise has confirmed unauthorised access involving application identities, disabled seven affected connections and said its investigation remains active.