[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_TXSzlI6pKsGggq-DsBKeBe_yH4MJMh9xc-HSVETCLU":3},{"article":4,"iocs":54,"watch_terms":55,"solutions":56,"lesson":33},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"6162d253-636b-4436-8d49-801f9fb30174","Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents","microsoft-blames-connectwise-attacks-on-chinese-state-hacker-using-artex-ai-agen-f6faed","A Chinese government-aligned hacking group used automated tools to carry out the recent supply chain attack on IT management software company ConnectWise and is using the same techniques to try to compromise organizations around the globe, Microsoft said.","Microsoft reports that a Chinese state-aligned group, Storm-0940, is leveraging an AI penetration testing framework called ARTEX to conduct supply chain attacks. This group has targeted various industries globally, including aerospace, defense, and finance, achieving privileged cloud access in under three hours in some instances. The ARTEX tool, originally intended for security research, has been taken offline by its developer due to its misuse by malicious actors.","Chinese state hackers use AI tool ARTEX for supply chain attacks on ConnectWise.","https:\u002F\u002Ftherecord.media\u002Fchina-cyber-connectwise-ai","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FAI_agents_1_e0b6353553.jpg","2026-10-22T16:30:00+00:00","2026-10-23T15:08:54.577162+00:00",9,[17,20,23,26,28],{"name":18,"type":19},"Storm-0940","threat_actor",{"name":21,"type":22},"ARTEX","product",{"name":24,"type":25},"Microsoft","vendor",{"name":27,"type":25},"ConnectWise",{"name":29,"type":30},"AI","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":31,"icon":33,"name":34,"slug":35},null,"Nation-state","nation-state",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[24,27,21],{"controls":57,"vendors":138},[58,86,112],{"slug":59,"name":60,"problem":61,"products":62},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[63,71,79],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":80,"vendor_name":24,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":87,"name":88,"problem":89,"products":90},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-cloud","Cortex Cloud","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcloud","Cloud security platform covering posture management and runtime protection.",{"vendor_slug":80,"vendor_name":24,"vendor_logo":81,"product_slug":108,"product_name":109,"url":110,"description":111},"defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,122,130],{"vendor_slug":80,"vendor_name":24,"vendor_logo":81,"product_slug":118,"product_name":119,"url":120,"description":121},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[139,142],{"slug":80,"name":24,"logo_path":81,"roles":140},[141],"reported_by",{"slug":143,"name":144,"logo_path":145,"roles":146},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png",[141]]