China-Linked Hackers Use ARTEX AI in Cyber Attack

Microsoft announced on Wednesday that the state-sponsored hacker group Storm-0940 is behind a recent cyber attack on the ConnectWise Cloud Backup application. The attack was facilitated by the use of ARTEX, a Go-based AI framework for penetration testing. This framework was shut down after its abusive use in cyber attacks on South Korean financial institutions. Storm-0940 is known for its targeted attacks on companies and institutions deemed strategically important to the Chinese government. The group has employed various techniques in the past to infiltrate networks and steal data.

The current incident demonstrates that the group has evolved its methods to leverage advanced technologies such as artificial intelligence. The use of ARTEX enables Storm-0940 to conduct attacks more quickly and efficiently. The framework offers a variety of features that allow attackers to identify and exploit vulnerabilities in software and networks. Microsoft has classified the vulnerability exploited in this attack as critical. The ConnectWise Cloud Backup application is used by numerous companies to secure their data.

The attack could potentially have serious consequences for the affected companies, as sensitive information is at risk. Microsoft has advised affected customers to promptly update their systems and strengthen security measures. The discovery of the attack comes at a time when the international community is increasingly concerned about cyber attacks originating from state-sponsored groups. The U.S. and other countries have repeatedly warned about the threats posed by such actors. The use of AI in cyber attacks could further increase the complexity and impact of such incidents.

Microsoft has already taken steps to close the security vulnerability and protect the affected systems. The company plans to provide an update for all users of the ConnectWise Cloud Backup application by the end of November 2026. The vulnerability is listed under CVE-2026-1234 and affects multiple versions of the software. The response to the attack highlights the importance of companies implementing proactive security strategies. Experts recommend conducting regular security audits and providing training for employees to raise awareness of cyber threats.

The use of AI in cybersecurity could also be a way to defend against such attacks. The incidents surrounding Storm-0940 are not isolated. In recent years, there have been several reports of similar attacks targeting companies across various sectors. The increasing complexity of attacks requires close collaboration between businesses and security authorities to develop effective defense measures. The threat of cyber attacks is expected to continue rising as more companies adopt digital technologies. The need to strengthen security protocols and stay up-to-date with technology is crucial to protect against such attacks. According to a study by Cybersecurity Ventures, the global damage from cybercrime is estimated to exceed $10 trillion by 2026.