---
type: "post"
id: "china-linked-hackers-breached-connectwise-using-ai-penetration-a92d8d"
slug: "china-linked-hackers-breached-connectwise-using-ai-penetration-a92d8d"
title: "China-linked hackers breached ConnectWise using AI penetration tool"
description: "Reuters reported on October 21 that Microsoft attributed a campaign targeting hundreds of organizations globally to Storm-0940, a group it tracks as China state-aligned."
retrieval_nugget: "Reuters reported on October 21 that Microsoft attributed a campaign targeting hundreds of organizations globally to Storm-0940, a group it tracks as China state-aligned."
published_at: "2026-10-23"
updated_at: "2026-10-23"
record_date: "2026-10-23"
date_kind: "published_at"
topics: ["ai-security","security"]
entities: ["ConnectWise","ConnectWise Cloud Backup","Microsoft","Storm-0940","ARTEX"]
related_patterns: []
novelty_label: "new_fact"
what_changed: "The story reports a ConnectWise Cloud Backup breach attributed to a China-aligned group using the ARTEX AI penetration-testing tool."
prior_refs: ["memory:621e4bda-c1d9-8cb6-a9f5-68d4c2f51c34"]
source_url: "https://www.reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21"
source_urls: ["https://www.reuters.com/technology/chinese-linked-hackers-compromise-connectwise-target-hundreds-global-attack-2026-10-21"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:china-linked-hackers-breached-connectwise-using-ai-penetration-a92d8d"
status: "published"
visuals: []
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/china-linked-hackers-breached-connectwise-using-ai-penetration-a92d8d/","markdown":"https://newruntime.com/posts/china-linked-hackers-breached-connectwise-using-ai-penetration-a92d8d.md","json":"https://newruntime.com/posts/china-linked-hackers-breached-connectwise-using-ai-penetration-a92d8d.json"}
---

# China-linked hackers breached ConnectWise using AI penetration tool

## Retrieval answer

Reuters reported on October 21 that Microsoft attributed a campaign targeting hundreds of organizations globally to Storm-0940, a group it tracks as China state-aligned.

Reuters reported on October 21 that Microsoft attributed a campaign targeting hundreds of organizations globally to Storm-0940, a group it tracks as China state-aligned. The group compromised ConnectWise Cloud Backup, according to Microsoft and ConnectWise.

ConnectWise CEO Manny Rivelo said the company contained affected application connections and was restoring services in controlled phases. He said those actions do not remove unauthorized access that may already have been established in individual customer tenants, which require separate review.

Microsoft said the attackers used ARTEX, an open-source penetration-testing framework that can use different AI models to automate penetration-testing tasks. The framework can be configured for autonomous reconnaissance and data exfiltration. Microsoft said most targeting attempts were unsuccessful, but that Storm-0940 obtained privileged cloud persistence at many organizations in a short period.

The report does not identify the AI models used, quantify affected ConnectWise customers, establish what data was accessed or exfiltrated, or provide a complete list of compromised organizations.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Ai Security](https://newruntime.com/topics/ai-security.md): Explore the ai-security topic hub.
- topic hub: [Security](https://newruntime.com/topics/security.md): Explore the security topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)