Story thread

ARTEX supply chain campaign

China-linked hackers used AI tools to compromise Microsoft 365 tenants and ConnectWise in a broad nation-state supply chain attack.

9 stories from 8 sources · since Oct 21

Clio’s read on this thread

Microsoft says a China-aligned actor used the ARTEX AI pentest tool to automate supply-chain attacks through ConnectWise and cloud identities, reaching hundreds to more than 2,200 Microsoft 365 tenants. Later reports expand the campaign’s scale, with CrowdStrike saying related activity targeted 200+ organizations in 11 days and compromised at least nine. CIOs should care because trusted vendors, SaaS identities, and AI automation now let attackers move faster than manual defenses.

Key points

  • Microsoft says ARTEX automated reconnaissance, password spraying, OAuth abuse, and privilege escalation.
  • ConnectWise compromise provided a supply-chain foothold into downstream Microsoft 365 and cloud tenants.
  • Reported impact ranges from hundreds of organizations to more than 2,250 tenants.
  • CrowdStrike later said 200+ organizations were targeted in 11 days, with at least nine compromises.
  • Coverage urges tighter third-party risk, identity governance, and anomaly detection.

Where coverage agrees

  • The campaign used AI tooling to scale and speed up attacks.Microsoft Security Blog · TechMeme · The Register · CSO Online · TechCrunch · Dark Reading · SecurityWeek · Newsletters
  • ConnectWise was the critical supply-chain entry point into downstream organizations.TechMeme · The Register · CSO Online · TechCrunch · Dark Reading · SecurityWeek · Newsletters
  • The attacks centered on cloud and Microsoft 365 identity abuse.Microsoft Security Blog · The Register · CSO Online · TechCrunch · Dark Reading · SecurityWeek · Newsletters
  • The operational lesson is that vendor access and identity controls need stronger governance and monitoring.Microsoft Security Blog · TechMeme · The Register · CSO Online · TechCrunch · Dark Reading · SecurityWeek · Newsletters

Where sources differ

  • Microsoft-linked reporting describes impact at more than 2,200-2,250 Microsoft 365 tenants, while CrowdStrike later says related activity targeted 200+ organizations in 11 days and compromised at least nine.Microsoft Security Blog · The Register · CSO Online · Dark Reading · SecurityWeek · Newsletters · TechMeme
  1. CrowdStrike: China-linked hackers used AI tool ARTEX with a DeepSeek LLM and another model to target 200+ organizations in 11 days, compromising at least nine (Kevin Collier/NBC News)TechMeme · Oct 30 · Clio 79
  2. China-nexus actor linked to attack on ConnectWise Cloud BackupNewsletters · Oct 23 · Clio 60
  3. China APT Uses AI Pentest Tool Artex in ConnectWise AttacksSecurityWeek · Oct 23 · Clio 83
  4. Microsoft Links Storm-0940 to ConnectWise Supply Chain AttackDark Reading · Oct 22 · Clio 79
  5. Chinese hackers spied on thousands of companies after breaching IT giant ConnectWiseTechCrunch · Oct 22 · Clio 78
  6. China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenantsCSO Online · Oct 22 · Clio 83
  7. Microsoft says ConnectWise breach let Chinese spies loose on 2,250 cloud tenantsThe Register · Oct 22 · Clio 78
  8. Microsoft says China-linked hackers used AI penetration testing tool ARTEX to compromise ConnectWise as part of a campaign targeting hundreds of organizations (AJ Vicens/Reuters)TechMeme · Oct 22 · Clio 73
  9. AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseMicrosoft Security Blog · Oct 21 · Clio 91