Microsoft says Chinese-linked hackers used AI tool to breach ConnectWise

Microsoft says a Chinese-linked hacking group used an AI-driven penetration-testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organisations globally, the company disclosed on Wednesday.

The group, which Microsoft tracks as Storm-0940, used an open-source penetration-testing framework called ARTEX to carry out the campaign. ARTEX lets users employ any AI model to automate pen-testing tasks and can be configured to run autonomous reconnaissance and data exfiltration, Microsoft said.

The attack targeted organisations across aerospace, defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, technology, think tanks and nonprofits. Microsoft said the majority of the targeting was not successful, but the group achieved privileged cloud persistence — high-level access that can survive cleanup — at many organisations in a brief time.

ConnectWise chief executive Manny Rivelo said that, based on Microsoft’s analysis and evidence available to the company, “it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup.” Rivelo said ConnectWise had contained the affected application connections and was restoring services in controlled phases, adding that customer tenants would require separate review. ConnectWise had said on 16 October that it was investigating recent attempts of unauthorised access to its Cloud Backup environment.

The Chinese Embassy in Washington did not immediately respond to a request for comment. Beijing regularly denies conducting or condoning cyber-enabled data theft.