China-linked hackers use AI pentesting tool to breach ConnectWise, Microsoft says

Microsoft said on Wednesday, October 21, 2026, that a China-linked hacking group, tracked internally as Storm-0940, compromised IT services company ConnectWise using an AI-automated penetration testing tool called ARTEX. According to the company, the campaign targeted hundreds of organizations worldwide, spanning sectors as distinct as aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks, and NGOs (source).

ConnectWise had already flagged a problem before Microsoft's report. In a statement published on its website on October 16, 2026, the company said it was investigating attempts at unauthorized access associated with its cloud backup environment:

investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment.

ConnectWise, official statement (October 16, 2026)

As of the publication of the Reuters report, ConnectWise had not responded to requests for comment on Microsoft's findings, and the Chinese Embassy in Washington also did not comment. Beijing routinely denies accusations of state-sponsored cyberespionage.

How ARTEX works

ARTEX is described by Microsoft as an open-source penetration testing framework, a category of legitimate tool used by security teams to test the resilience of networks and services. The concerning difference is the degree of automation: ARTEX allows any AI model to be plugged into the process and configured to run autonomous tasks, including target reconnaissance and data exfiltration, without the need for continuous manual operation by a human attacker.

In practice, this means that the same type of tool an offensive security team would use to simulate an attack and identify flaws became, in Storm-0940's hands, an automated breach pipeline. Microsoft states that most of the intrusion attempts were unsuccessful, but that the group managed to obtain privileged persistence in cloud environments (high-level access capable of surviving cleanup efforts) at several organizations, and within a short timeframe.

Why this matters for Brazil's IT landscape

The source does not cite victims in Brazil, and it's important not to mistake this for a confirmation that doesn't exist. But the angle matters here for another reason: ConnectWise isn't a product for a single company's internal use, it's an RMM (remote monitoring and management) and PSA (professional services automation) platform built precisely to be operated by managed service providers, or MSPs.

In short: when a vendor of this type is compromised, the risk isn't confined to the vendor itself. It spreads to the portfolio of clients the MSP manages remotely, often with privileged access to servers, endpoints, and backups. A large share of Brazil's small and medium-sized business base outsources exactly this type of operation to local providers who run tools like ConnectWise as part of their own business model.

This doesn't mean every ConnectWise installation in the country is compromised, nor did Microsoft or ConnectWise say so. It means any IT or DevOps team that depends on an MSP, or that runs ConnectWise internally, has a concrete reason to check its own environment now, rather than waiting for a more detailed statement.

Checklist: what to check now

Neither Microsoft nor ConnectWise has released an official incident response roadmap so far. But given the type of compromise described (privileged cloud persistence via AI automation), a minimal verification checklist, basic security hygiene for anyone administering or depending on a ConnectWise instance, typically includes:

• Review and rotate credentials for administrative accounts and ConnectWise API keys, including cloud backup integrations;
• Audit OAuth application registrations and service principals recently created in cloud environments connected to ConnectWise, looking for persistence that shouldn't exist;
• Confirm that multi-factor authentication is mandatory for all administrative access to the platform, not just end-user accounts;
• Apply the updates and fixes ConnectWise releases in response to the incident, rather than postponing the maintenance window;
• Isolate, where possible, the RMM management network from the rest of the infrastructure, limiting the blast radius should a credential be compromised.

None of these steps depend on the investigation's final confirmation: they count as basic hygiene for any remote IT management platform, precisely because this type of tool is a valuable target for anyone looking to jump from one vendor to dozens of clients at once.

What remains open

According to the source, Microsoft has not publicly detailed the exact extent of the persistence Storm-0940 obtained within ConnectWise's infrastructure, nor how many of the affected organizations had data actually exfiltrated versus merely being targeted by an attempt. ConnectWise also had not confirmed, as of the original report's deadline, Microsoft's findings regarding the use of ARTEX. For anyone operating or depending on the platform, the practical recommendation while these details are pending is to treat the alert as a trigger for an audit, not as news to file away.

Source

ET Tech (India): Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says (Reuters, October 22, 2026).