Microsoft blames ConnectWise attacks on Chinese state hacker using ARTEX AI agents - The Record from Recorded Future News
A Chinese government-aligned hacking group used AI-powered tools to attack ConnectWise and is targeting hundreds of other organizations globally, Microsoft reported Wednesday.
Microsoft has been investigating a series of attacks by a Chinese state-sponsored hacking group called Storm-0940, which used an AI penetration testing framework named ARTEX to breach IT management software company ConnectWise and target hundreds of other organizations worldwide.
Since September, the group has compromised organizations across government, aerospace, defense, finance, manufacturing, technology and energy sectors, conducting reconnaissance, acquiring credentials and expanding privileges for data collection.
AI Accelerated Attacks
Microsoft highlighted how AI has significantly accelerated the hackers' ability to breach targets, with multiple instances showing the threat actors gaining privileged access in less than three hours from initial targeting.
While the majority of the targeting wasn't successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.
Storm-0940 has been active since 2021 and typically conducts attacks for data theft purposes, targeting internet-facing applications and using compromised accounts to expand access.
ARTEX Framework
ARTEX is a penetration testing tool that allows users to deploy any AI model to automate offensive security actions, coordinating autonomous agents to run penetration tests from reconnaissance through data exfiltration with minimal human interaction.
The tool was released on GitHub earlier this year as open-source by an account known as 'Autumn-27' and has been implicated in attacks on South Korean and Japanese financial institutions, according to Zscaler researchers.
Developer Li Puhua recently announced on GitHub that ARTEX would be converted to closed source after being abused by malicious actors, denying responsibility for crimes committed with it.
ConnectWise Impact
Over the weekend, ConnectWise was forced to shut down several services after Microsoft and other cybersecurity companies warned of a supply-chain attack impacting Cloud Backup, which helps protect data in Microsoft 365 and Google Workspace.
Attackers used stolen Cloud Backup credentials to gain wide access to systems where the app is installed, with Microsoft noting the activity demonstrates how threat actors are integrating agentic AI into existing offensive security workflows.
Related
