Chinese-linked hackers compromise ConnectWise, target hundreds in global attack: Microsoft

Microsoft said the majority of the targeting was not successful, but Storm-0940 achieved privileged cloud persistence at many organisations in a brief time.

Microsoft said a Chinese-linked group, Storm-0940, used the AI tool ARTEX to breach ConnectWise and target hundreds of organisations worldwide.

ConnectWise said a China state-aligned group likely attacked its Cloud Backup service and that it has contained affected connections and is restoring services in phases.

The campaign hit many sectors, including defence, finance and government, and Microsoft warned the hackers gained privileged cloud persistence at many firms despite most attacks failing.

A Chinese-linked hacking group used an AI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organisations globally, Microsoft said on Oct 21.

Based on Microsoft’s analysis and evidence available to ConnectWise, “it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup”, ConnectWise chief executive officer Manny Rivelo said in a separate statement.

Rivelo said ConnectWise “contained the affected application connections and are restoring services in controlled phases”.

He added that “those actions do not remove unauthorised access that may have already been established within individual customer tenants, which require separate review”.

The Chinese Embassy in Washington did not immediately respond to a request for . Beijing regularly denies conducting or condoning cyber-enabled data theft.

The hackers, which Microsoft tracks as Storm-0940, used an open-source penetration testing framework called ARTEX to carry out the campaign, Microsoft said.

There are multiple tools used to conduct penetration testing, a form of legitimate testing of the security of networks or services.

ARTEX allows users to use any AI model to automate a variety of penetration testing tasks and can be configured to run autonomous tasks including reconnaissance and data exfiltration, Microsoft said.

The attack targeted organisations across a wide variety of sectors, including aerospace, defence, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and non-profit organisations, Microsoft said.

While the majority of the targeting was not successful, Microsoft said, Storm-0940 achieved privileged cloud persistence – or high-level access that could continue even after clean-up efforts – at many organisations in a brief time. REUTERS

AI/artificial intelligence