Chinese-Linked Hackers Used AI Tool in ConnectWise Breach, Microsoft Says

WASHINGTON, Oct 22: A Chinese state-aligned hacking group used an artificial intelligence-powered penetration-testing framework in a cyber campaign that compromised IT services firm ConnectWise and targeted hundreds of organizations worldwide, Microsoft said Wednesday.

In a security blog, Microsoft attributed the activity to Storm-0940, a hacking group it said had been operating since 2021. The targets included organizations in the government, defense, energy, financial services and technology sectors.

The attackers used ARTEX, an open-source penetration-testing framework that connects to artificial intelligence models to automate tasks ranging from identifying security weaknesses to stealing data.

Although penetration-testing tools are normally used by security professionals to assess vulnerabilities, Microsoft said the hackers exploited the framework to accelerate their operations.

In several cases, the attackers obtained high-level access to cloud systems less than three hours after selecting a target. Most attempts were unsuccessful, but the group established persistent access at multiple organizations, Microsoft said.

Microsoft cautioned that successful sign-ins did not necessarily mean customer data had been accessed or stolen.

ConnectWise said evidence gathered by the company, including Microsoft's threat intelligence, indicated that a Chinese state-aligned group was responsible for the attack on Cloud Backup, formerly known as SkyKick.

The company said it had contained the affected application connections and begun restoring services in phases after completing security checks.

However, ConnectWise warned that restoring its services and containing the affected connections would not automatically eliminate unauthorized access that might have been established within individual customers' Microsoft 365 environments. Those environments require separate investigations.

In an update Thursday, ConnectWise said the restoration process was expected to take several days. Existing backup archives remained encrypted, isolated and preserved, with no indication that they had been compromised, the company said.

ConnectWise urged customers to keep affected connections disabled until it issued formal instructions authorizing reconnection.

The company said the original mechanism through which the credentials were exposed remained under investigation. It had not determined whether a product vulnerability contributed to the incident.

China's Embassy in Washington rejected accusations implicating Beijing, saying China opposed hacking and what it described as attempts to smear the country.