AI Agents Now Automating China-Linked Supply-Chain Attacks

The clock just got shorter

China-linked threat actor Storm-0940 has been around since 2021, methodically harvesting data across a broad set of industries. But according to a Microsoft advisory released October 21, the group began deploying an AI-powered penetration testing framework called ARTEX in September — and the timeline of compromise has collapsed dramatically.

In some cases, the attacker moved from initial target selection to admin-level access inside a victim’s cloud environment in under three hours. Most attempts fail, but Microsoft reports the group has successfully breached hundreds of organizations worldwide, securing persistent footholds even as individual attacks stumble.

That speed is the story. And it changes everything about how businesses should think about supply-chain risk.

What ARTEX actually does

ARTEX is an open-source penetration testing tool. On its own, it is not malicious. Developed by security researchers to help organizations validate their own defenses, the framework automates the kind of reconnaissance and exploitation workflows that traditionally required a skilled human operator working through a shift or two.

When paired with an arbitrary AI model, however, ARTEX can automate the full attack chain — reconnaissance, credential harvesting, lateral movement, and data exfoliation — with minimal human intervention. It supports Japanese, Korean, Chinese, Spanish, and English, which gives it a wider targeting palette than most threat-actor tooling. That multilingual capacity is not incidental. It signals deliberate planning to operate across regions where English-first security tools often lag.

Microsoft confirmed ARTEX was used in a September breach of a South Korean financial institution that exposed personal data — the same pattern seen in the ConnectWise incident. GMO Cybersecurity by Yellae also identified the framework in unauthorized access attempts against Japanese companies, eight of which had already disclosed breaches between September and October.

The danger is not a single sophisticated actor sitting behind a keyboard. It is a reusable, AI-driven methodology that anyone with access can run at scale, day and night, across every time zone simultaneously. The barrier to entry has never been lower, and the barrier to detection has never been higher.

How the ConnectWise compromise works

The ConnectWise Cloud Backup attack is a textbook supply-chain compromise with a twist that makes it harder to defend against. Storm-0940 obtained credentials for ConnectWise’s cloud backup applications and then exploited pre-authorized access permissions those apps already held inside customer Microsoft 365 environments.

In plain terms: the attackers did not need to trick users into signing in. They impersonated legitimate apps and walked through the front door using access rights the organization itself had granted. This is the distinction that matters most. Every phishing-awareness program in the world will not protect you from an attacker who never asked you to click anything.

Microsoft’s numbers are stark. The group attempted sign-ins at a rate of 2,900 per minute against more than 2,250 organizations’ tenants. In some environments, they succeeded — collecting internal information, adding new authentication credentials to the apps, and assigning administrative privileges. The sheer volume of attempts suggests the operation was designed to find weak points through attrition rather than precision, which is exactly the kind of work an AI agent excels at.

Critically, Microsoft emphasized that no Microsoft product or system vulnerability was involved. The breach happened entirely through legitimate access paths that the organizations themselves configured. That means the fix is not a software patch. It is a governance decision — and most organizations have not made it yet.

Why the backdoor lingers

Even after ConnectWise issues its remediation guidance, the damage may not stop. The attackers added their own credentials and elevated permissions inside victim tenants. If those changes go undetected, they remain as dormant backdoors — accessible long after the initial intrusion is contained.

Microsoft is explicitly advising against deleting the compromised apps immediately. Deletion would destroy forensic evidence and could trigger alerting that notifies the attackers their access is compromised. Instead, affected organizations should keep the apps disabled until ConnectWise publishes its official recovery procedure, then work through the investigation step by step.

The advisory recommends reviewing sign-in and audit logs going back to at least October 15 — ideally October 1 — and looking for unfamiliar credential additions, unauthorized permission changes, and suspicious email or file access. Any anomaly found should trigger immediate credential revocation and password rotation.

For organizations that relied on ConnectWise Cloud Backup before the attack window, the question is whether their environment still retains any of the attacker-added privileges. That audit must start now, not after the next breach makes the headlines. And it should extend beyond ConnectWise. Any third-party application with admin-level permissions in your environment is a potential vector for the same approach.

The Japanese connection

GMO Cybersecurity by Yellae reported on October 19 that it observed ARTEX being used in unauthorized access attempts against roughly 20 Japanese companies. Eight of those organizations had already disclosed data breaches between September and October.

Microsoft did not formally link the Japanese attacks to Storm-0940, noting that multiple regions are using the ARTEX framework. The absence of a confirmed attribution does not reduce the risk — it means organizations in Japan and elsewhere cannot assume they are outside the target set simply because Microsoft has not named them. The framework is open source. That alone guarantees diversification of users.

The multilingual nature of ARTEX, combined with the geographic spread of activity, points to a broader ecosystem of actors adopting the same methodology. Storm-0940 may be the most organized user, but it is almost certainly not the only one.

Who wins, who loses, and what comes next

The winners here are the attackers. AI agents do not sleep. They do not take weekends off. They do not get tired of repeating the same exploit thousands of times until one sticks. A human attacker targeting hundreds of organizations would face fatigue, errors, and diminishing returns. An AI agent scales that effort linearly.

The losers are organizations that treated third-party app permissions as a one-time setup task. Every ConnectWise-dependent business — and there are thousands — is now on the target list. The same logic applies to any SaaS ecosystem where external apps hold broad access to internal environments. The ConnectWise compromise is not a ConnectWise problem. It is a third-party access problem, and ConnectWise is simply the latest example.

The second-order effects are already visible. Security teams are scrambling to audit app authorization histories across their Microsoft 365 tenants. Insurers are reassessing cyber liability exposures tied to managed service provider relationships. Regulators in South Korea and Japan are beginning to ask whether disclosure timelines for supply-chain breaches are adequate. And open-source security tooling is facing an uncomfortable reckoning — tools built for defense are now being used offensively at scale, and the line between the two is blurring faster than any policy framework can address.

What happens next is likely a shift in how security teams validate app permissions. The era of “trust and forget” on third-party access is over. Continuous monitoring of admin-level permissions, mandatory review of app authorization histories, and strict least-privilege policies will move from best practice to baseline requirement. Organizations that built their security posture around perimeter defenses and phishing awareness alone will find those investments insufficient against an attacker who never needed to trick a single human being.

The ConnectWise compromise did not exploit a flaw in technology. It exploited a flaw in oversight. AI agents like ARTEX simply make that oversight gap a lot cheaper to exploit — and a lot harder to detect once the agent has moved on to the next target.