Microsoft Says Chinese-Linked Hackers Used AI Tool ARTEX to Breach ConnectWise and Target Hundreds of Organizations
Microsoft says a Chinese-linked hacking group it tracks as Storm-0940 used the open-source ARTEX tool to automate attacks against hundreds of organizations through a ConnectWise compromise.
Microsoft said on Wednesday that a Chinese-linked hacking group used an AI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organizations globally.
The hackers, which Microsoft tracks as Storm-0940, used an open-source penetration testing framework called ARTEX to carry out the campaign, Microsoft said. ARTEX allows users to use any AI model to automate a variety of penetration testing tasks and can be configured to run autonomous tasks including reconnaissance and data exfiltration.
The attack targeted organizations across a wide variety of sectors, including aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and nonprofits, according to Microsoft.
While the majority of the targeting was not successful, Microsoft said, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time. That means the group obtained high-level access that could continue even after cleanup efforts.
ConnectWise and Beijing respond
ConnectWise did not immediately respond to a request for comment on Microsoft’s conclusions, although a statement posted to the company’s website on October 16 said it was “investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment.” The Chinese Embassy in Washington did not immediately respond to a request for comment. Beijing regularly denies conducting or condoning cyber-enabled data theft.
Reporting based on coverage by Reuters.
