China-Linked Hackers Used AI Tool in Global Cyberattacks, Microsoft Says

A hacking group aligned with the Chinese regime used an artificial intelligence (AI) tool to accelerate cyberattacks against hundreds of organizations worldwide, including an attack involving U.S. technology company ConnectWise, Microsoft said on Oct. 21.

Microsoft attributed the compromise of ConnectWise’s Cloud Backup application credentials to Storm-0940, a China state-aligned hacking group it has tracked since 2021. The stolen credentials allowed the attackers to exploit access already granted to ConnectWise applications by customers using Microsoft’s cloud services.

The hackers used ARTEX, a Chinese-developed AI security-testing tool, to automate attacks targeting government agencies, defense contractors, financial institutions, technology companies, and other organizations, Microsoft said.

In multiple cases, the group obtained privileged access to organizations’ cloud systems in less than three hours after initially targeting them.

ConnectWise Responds to Attack

ConnectWise confirmed unauthorized access to credentials associated with its Cloud Backup service, formerly known as SkyKick.

In an Oct. 25 update, the company said its existing backup archives remained encrypted, isolated, and preserved, with no indication that they had been compromised. It also reported no indication that other ConnectWise products or services were affected.

The intrusion disrupted access to Cloud Backup while ConnectWise and outside specialists investigated the incident and worked to restore services.

ConnectWise planned to begin allowing partners to restore data from existing backups on Oct. 26, followed by phased re-enrollment into the service.

The company advised customers to keep affected application connections disabled until receiving restoration instructions and to examine their Microsoft 365 environments for unauthorized activity.

How the AI-Assisted Attacks Worked

ConnectWise provides technology to IT service providers that manage computer systems for other businesses.

Its Cloud Backup applications had already been authorized to access customers’ Microsoft 365 environments. By obtaining the applications’ credentials, the hackers could attempt access without requiring employees to sign in or approve new requests.

Microsoft said Storm-0940 used ARTEX to automate scanning, password attempts, and exploitation of the permissions granted to the compromised applications.

The group attempted to sign in to more than 2,250 customer cloud environments through the compromised ConnectWise applications. The figure represents attempted access, not confirmed breaches.

At multiple organizations, the attackers gained privileged access. Microsoft observed them examining cloud resources, modifying application credentials, and attempting to change permissions.

Such changes could allow attackers to maintain access even after the original compromised credentials were disabled. Microsoft said successful access did not necessarily mean customer data had been stolen.

ARTEX was previously identified in attacks against South Korean financial institutions and Japanese companies. Japanese investigators found ARTEX on six overseas servers targeting approximately 80 businesses. Microsoft did not identify Storm-0940 as responsible for those earlier attacks.

Originally developed to help security professionals test computer systems for weaknesses, ARTEX uses AI to plan operations, direct other tools, and pursue different ways into a network with limited human intervention.

Microsoft said the automation allowed Storm-0940 to carry out operations simultaneously and exploit stolen credentials at high speed.

“The speed of the activity allows very little time for Defenders to respond to those alerts,” Microsoft’s researchers wrote.

Although most targeting attempts failed, Microsoft said the group established privileged access that could persist at many organizations. In some affected environments, attackers modified application credentials and permissions, potentially allowing unauthorized access to continue even after the original compromised application was secured.

Developer and Company Responses

The ARTEX creator, who uses the online name Autumn-27, condemned the tool’s misuse in an Oct. 8 public statement and denied involvement in the reported attacks. The developer announced that the project would stop receiving public updates and maintenance support and become closed-source.

Chinese cybersecurity company ThreatBook said in an Oct. 16 announcement that ARTEX originated as a personal project of its RedAgents product lead. The company acknowledged that the open-source version had been misused in major financial sector security incidents and lacked built-in security controls.

The Epoch Times contacted ThreatBook, Microsoft, and ConnectWise for additional comment on the new findings. None had responded by production time. The ARTEX developer could not be reached for comment.