Return to Threats

China APT Uses AI Pentest Tool Artex in ConnectWise Attacks

securityweek.com 2026-10-23 AI agent abuse Critical
Run AI Security Assessment Talk to AI CISO

Executive Summary

A China-linked threat actor used Artex to automate ConnectWise-related intrusions against hundreds of organizations, with privileged access obtained in some environments. ConnectWise customers, identity administrators, and teams operating AI-enabled security or automation tools should prioritize agent permissions, credential protection, and activity monitoring.

What Happened

The state-sponsored hackers targeted hundreds of organizations and gained privileged access to some environments. The post China APT Uses AI Pentest Tool Artex in ConnectWise Attacks appeared first on SecurityWeek .

Affected Products

  • Artex
  • ConnectWise

Vulnerability / Attack Technique

AI-automated reconnaissance, password spraying, and OAuth application abuse

Technical Mechanism

The reported campaign used Artex to automate reconnaissance and password-spraying activity against ConnectWise customer environments. The summary states that the attackers gained privileged access to some environments, but it does not describe the underlying implementation or specific exploit.

AI Security Category

AI-assisted attack

Part of the AI-Assisted Attacks topic.

Relevant Frameworks

MITRE ATLAS: ReconnaissanceMITRE ATLAS: Initial AccessMITRE ATLAS: Credential AccessMITRE ATLAS: Privilege EscalationMITRE ATLAS: Discovery

RealGround Analysis

This incident shows how AI-enabled offensive tooling can increase the scale and speed of attacks against systems that are not themselves AI applications. Teams running AI agents or LLM applications should enforce narrowly scoped identities, require approval for privileged actions, and monitor automated authentication and directory activity for abnormal behavior.

Recommended Controls

  • Apply least-privilege permissions to AI agents, service accounts, OAuth applications, and connected security tools.
  • Require human approval and step-up authentication for credential changes, privilege changes, and other high-impact identity actions.
  • Monitor and rate-limit password-spraying, automated reconnaissance, OAuth abuse, and anomalous service-account activity.
  • Use separate credentials and isolated environments for AI-enabled penetration-testing tools.
  • Continuously review agent action logs, identity changes, and privileged access for unauthorized automation.

Related RealGround Service

AI Agent Business Logic Audit · or start with the free AI Agent Security Scanner.

Sources

securityweek.com: https://www.securityweek.com/china-apt-uses-ai-pentest-tool-artex-in-connectwise-attacks/

Summary and analysis written by RealGround from the source above; last updated 2026-10-24.

Talk to AI CISO