A hacking group linked to China employed an artificial intelligence-driven penetration testing tool to breach the IT services company ConnectWise, according to Microsoft’s analysis released on October 21. The attack was part of a broader campaign targeting hundreds of organizations worldwide across multiple sectors.

ConnectWise chief executive officer Manny Rivelo confirmed that a China state-aligned group was likely responsible for the breach of ConnectWise Cloud Backup services. He stated that the company had contained the affected application connections and was restoring services in a controlled manner. However, Rivelo cautioned that these measures do not eliminate unauthorized access that may have already been established within individual customer environments, emphasizing the need for separate reviews by affected clients.

Microsoft identified the hacking group as Storm-0940 and detailed the use of an open-source penetration testing framework known as ARTEX in the operation. ARTEX leverages AI models to automate various penetration testing tasks, including reconnaissance and data exfiltration, and can be configured to operate autonomously. While penetration testing tools are commonly used legitimately to assess network security, in this case, they were employed with malicious intent.

The campaign targeted a diverse range of industries, including aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, tank-tanks, and nonprofit organizations. Although many attempts were unsuccessful, Microsoft reported that Storm-0940 achieved high-level cloud access, known as privileged cloud persistence, in numerous organizations within a short timeframe. This level of access allows attackers to maintain control even after mitigation efforts.

In response, a spokesperson from the Chinese Embassy in Washington stated that China opposes and combats hacking activities in accordance with the law. The spokesperson also condemned what they described as smears and attacks against China justified by cybersecurity concerns.

The incident highlights the increasing use of AI-driven tools in cyber espionage and the continuing challenges organizations face in securing cloud environments against sophisticated threats. ConnectWise and affected organizations continue to address the breach and assess potential impacts.