Chinese hackers use AI to target ConnectWise and global victims

JAKARTA - A China-linked hacking group is suspected of infiltrating the systems of information technology company ConnectWise using an artificial intelligence (AI)-powered penetration testing tool.

Microsoft said the attack was part of a cyber campaign targeting hundreds of organisations worldwide.

As reported by Reuters , ConnectWise CEO Manny Rivelo said Microsoft's analysis and the evidence available to the company pointed to the suspected involvement of a China state-affiliated group in an attack on ConnectWise Cloud Backup.

"It appears that a China state-affiliated group was responsible for the attack on ConnectWise Cloud Backup," Rivelo said in a separate statement.

Rivelo explained that ConnectWise had restricted connections to the affected application and begun restoring services gradually.

However, restoring services does not automatically eliminate all security risks. Rivelo warned that unauthorised access may have been established within individual customers' cloud environments, requiring separate investigations.

"These actions do not eliminate unauthorised access that may have been established within individual customer environments, which require separate investigations," he said.

Microsoft Identifies Storm-0940 Group

Microsoft identified the hacking group as Storm-0940. In its attacks, the group used ARTEX, an open-source penetration testing framework that can automate various tasks with the assistance of AI models.

Penetration testing is a method used to assess the security of networks and services.

However, ARTEX's ability to perform tasks autonomously can be exploited for malicious activities, including system reconnaissance and unauthorised data collection.

Microsoft said most of the targeting attempts in the campaign were unsuccessful.

Nevertheless, Storm-0940 managed to maintain high-level access to the cloud environments of several organisations for a short period.

Such access may persist even after organisations have carried out system clean-ups.

Attacks Target Strategic Industries

The campaign targeted various sectors, including financial services, energy, defence, aerospace, automotive, chemicals, government, manufacturing, media, military, semiconductors and technology.

Organisations in the legal and software industries, think tanks and non-profit organisations were also among the targets identified by Microsoft.

Attacks on IT service providers can pose widespread risks because access to a provider's systems may create a pathway into its customers' cloud environments. However, Microsoft did not say that all the targeted organisations had been successfully breached.

Meanwhile, the Chinese government denied the allegations. A spokesperson for the Chinese Embassy in Washington said China opposed hacking activities and rejected accusations that it was being targeted under the pretext of cybersecurity concerns.

"China opposes and combats hacking activities in accordance with the law. At the same time, we oppose smears and attacks against China under the pretext of cybersecurity issues," the spokesperson said. (DH/LM)