Britain’s National Cyber Security Centre (NCSC), part of the Government Communications Headquarters (GCHQ), is intensifying its investigation into a hacking campaign believed to be backed by Beijing, amid concerns that sensitive information across multiple sectors may have been compromised. The NCSC is collaborating with technology firms including Microsoft to determine whether British organisations have been targeted or affected.

Last week, Microsoft revealed a wide-reaching global campaign linked to a China-state aligned hacking group known as Storm-0940. The operation reportedly uses artificial intelligence (AI) to launch sophisticated cyberattacks against hundreds of organisations across industries such as defence, energy, finance, government, and technology. Microsoft said the attackers have been active since at least September and have demonstrated the ability to gain access to cloud infrastructures within hours.

One notable target was ConnectWise, a US-based company providing cloud services widely used for Microsoft 365 email and file backup by major organisations. ConnectWise disclosed it suffered a supply chain attack as part of the campaign, prompting it to suspend its services while assessing the breach. The company informed the UK’s Information Commissioner’s Office (ICO) of the incident, which is currently under review. Although ConnectWise stated there was no evidence that stored backups were compromised, it acknowledged that disabling its service would not necessarily block attackers from accessing systems already infiltrated.

Microsoft security researchers highlighted that AI tools employed in these attacks are unrestricted by human limitations, enabling continuous operation and rapid exploration of multiple attack vectors. This capability significantly accelerates breach timelines and increases the complexity and impact of cyber intrusions.

The surge in AI-enhanced hacking coincides with a recent vulnerability discovered in PHP, a widely used programming language underpinning approximately 70% of global websites. AI-driven agents exploited the flaw, causing governments and companies worldwide to temporarily take websites offline to apply patches and prevent further attacks. Cybersecurity experts caution that AI technology could soon uncover additional vulnerabilities, posing heightened risks to internet infrastructure, critical systems, and corporate networks. Jason Clinton, deputy chief information security officer at AI firm Anthropic, warned that cyber threats could intensify before improving.

The China-aligned group behind this recent hacking spree reportedly utilized "Artex," an open-source AI software released publicly in July by a Chinese developer, enabling broad access and modification. In response to escalating threats, UK ministers announced plans to invest hundreds of millions of pounds in AI security measures aimed at strengthening defences against emerging cyberattacks.

ConnectWise chief executive Manny Rivelo emphasised the growing focus of nation-state actors on software supply chains, noting that compromising a single trusted connection can provide access to numerous organisations. He added that AI allows attackers to conduct testing and exploitation at unprecedented "machine speed." Rivelo confirmed that affected applications have been contained and that service restoration is underway in a controlled manner.