What We Know
Microsoft has attributed attacks involving ConnectWise to Storm-0940, a China-linked or China-state-aligned threat group, and says the group used the agentic AI penetration-testing framework ARTEX.3Backed by 3 sourcesmicrosoft.comCyberScooptherecord.media The campaign targeted ConnectWise and other organizations through a supply-chain attack, according to reporting based on Microsoft’s assessment.2Backed by 2 sourcesmicrosoft.comCyberScoop
Reports describe the operation as global and say hundreds of organizations were targeted, with the attackers gaining privileged access in some environments.2Backed by 2 sourcesinvesting.comCNA Wiz said it was tracking an ARTEX-using actor overlapping with Storm-0940 across multiple targeted software and IT vendors, indicating that the activity extends beyond a single ConnectWise incident.2Backed by 2 sourcestherecord.mediawiz.io
The operation targeted hundreds of organizations and gained privileged access in some environments.1Context from one sourcesecurityweek.com
Source Comparison
Aligned reportingCorroborates
- microsoft.com↗Microsoft’s security research identifies an AI-driven ARTEX campaign involving a supply-chain compromise, supporting the briefing’s attribution and attack-path account.
- investing.com↗The Reuters report supports the account of a China-linked ConnectWise compromise affecting hundreds of organizations in a global operation.
- CyberScoop↗CyberScoop supports Microsoft’s attribution of the ConnectWise supply-chain attack to Storm-0940 and its use of ARTEX.
- CNA↗CNA reproduces the reported account of a global attack on hundreds of targets involving a ConnectWise compromise.
- therecord.media↗The Record supports the attribution to a Chinese state-linked actor using ARTEX and reports Wiz’s assessment that related activity reached multiple software and IT vendors.
- wiz.io↗Wiz reports an ARTEX-using actor overlapping with Storm-0940 while targeting multiple software and IT vendors, extending the activity beyond ConnectWise.