Zero Radar
← feed
CriticalSecurity incidentupdated 25 Oct 2026, 15:24 UTC

China-linked hackers used AI attack tool in ConnectWise supply chain breach

A state-linked hacking group broke into ConnectWise's cloud backup software and used an AI-driven tool to speed up attacks on many customer accounts. Organizations that use this backup product may have been targeted.

Attacks reported (Dark Reading, The Hacker News)2 independent sources
SeverityCriticalSecurity incident
Being exploited?ReportedBy Dark Reading, The Hacker News, not officially confirmed yet
What to doCheck exposureCheck whether you use ConnectWise Cloud Backup and, if so, follow vendor guidance and review your accounts for compromise.
How sure is this?2 independent sourcesSeveral independent publishers agree

How the attack works simplified

  1. 1Storm-0940 actorChina state-aligned group targets supplier
  2. 2ConnectWise backup appSupply chain compromise of trusted software
  3. 3ARTEX AI toolAgentic pentest framework automates attack
  4. 42,200+ tenantsCustomer environments reached through the app
  5. ResultMany customer tenants exposed to attackers

What happened

Microsoft attributes a supply chain compromise of the ConnectWise Cloud Backup application to Storm-0940, a China state-aligned actor that used the ARTEX agentic AI penetration-testing framework to automate and accelerate its attacks.

Why it is dangerous: The attack reportedly reached more than 2,200 tenants, so any organization whose backups or management tools run through this application may have been exposed to the same actor.

Are you affected?

You are affected if you use ConnectWise Cloud Backup, as the application was compromised in the supply chain attack.

ConnectWise Cloud Backup application (versions unknown)

What to do

  1. Check whether your organization uses ConnectWise Cloud Backup and review your tenant for signs of compromise
  2. Follow ConnectWise and Microsoft guidance for remediation and any recommended credential resets
  3. Review access logs for unusual activity in your backup and connected cloud accounts

Timeline

  1. 22 Oct 2026, 04:21 UTC
    Publicly disclosed
  2. 22 Oct 2026, 20:42 UTC
    Reported by Dark Reading · Dark Reading
  3. 25 Oct 2026, 13:32 UTC
    Picked up by Zero Radar
  4. 25 Oct 2026, 15:24 UTC
    The Hacker News reported on it · The Hacker News

Sources 2 reports, oldest first

Security press established security newsrooms

Technical details

ID
ZR-778da976 · ZR-9b69347c
Disclosed
22 Oct 2026, 04:21 UTC
On Zero Radar
25 Oct 2026, 13:32 UTC (3 days after disclosure)
Last change
25 Oct 2026, 15:24 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

China-linked hackers used AI attack tool in ConnectWise supply chain breach · Zero Radar