A hacking group aligned with the Chinese regime used an artificial intelligence tool to accelerate cyberattacks against hundreds of organizations worldwide, including an attack involving U.S. technology company ConnectWise, Microsoft said on Oct. 21.

Microsoft attributed the compromise of ConnectWise’s Cloud Backup application credentials to Storm-0940, a China state-aligned hacking group it has tracked since 2021. The stolen credentials allowed the attackers to exploit access already granted to ConnectWise applications by customers using Microsoft’s cloud services.

The hackers used ARTEX, a Chinese-developed AI security-testing tool, to automate attacks targeting government agencies, defense contractors, financial institutions, technology companies, and other organizations, Microsoft said.

In multiple cases, the group obtained privileged access to organizations’ cloud systems less than three hours after initially targeting them.

ConnectWise Responds to Attack

In a statement provided to The Epoch Times on Oct. 26, ConnectWise confirmed unauthorized access to application identities associated with its Cloud Backup service, formerly known as SkyKick.

The company said it disabled affected application connections, interrupting Cloud Backup and two integrated services—SaaS Security and Cloud Management—while its investigation and remediation continue.

ConnectWise said it had found no indication that customer backup data had been compromised. It said it had remediated identified compromised credentials and identities and had observed no successful threat activity in the environments it monitors since implementing those measures.

ConnectWise CEO Manny Rivelo said the company’s evidence, including intelligence shared by Microsoft, indicated that a China state-aligned group was responsible for the attack.

“Nation-state actors are increasingly targeting the software supply chain, because one trusted connection can open the door to many organizations,” Rivelo said in a statement provided to The Epoch Times.

Rivelo also warned that securing ConnectWise’s systems did not necessarily eliminate unauthorized access already established in its customers’ cloud environments.

“Those actions do not remove unauthorized access that may already have been established within individual customer tenants, which require separate review,” he said.

In an Oct. 26 update, ConnectWise said it was still preparing for the phased restoration of Cloud Backup services. The company said access to existing backups would come first, followed by full service re-enrollment, but did not announce when partners could begin restoring data.

The company advised customers to keep affected application connections disabled until receiving restoration instructions and to examine their Microsoft 365 environments for unauthorized activity.

How the AI-assisted Attacks Worked

ConnectWise provides technology to IT service providers that manage computer systems for other businesses.

Its Cloud Backup applications had already been authorized to access customers’ Microsoft 365 environments. By obtaining the applications’ credentials, the hackers could attempt access without requiring employees to sign in or approve new requests.

Microsoft said Storm-0940 used ARTEX to automate scanning, password attempts, and exploitation of the permissions granted to the compromised applications.

The group attempted to sign in to more than 2,250 customer cloud environments through the compromised ConnectWise applications. The figure represents attempted access, not confirmed breaches.

At multiple organizations, the attackers gained privileged access. Microsoft observed them examining cloud resources, modifying application credentials, and attempting to change permissions.

Such changes could allow attackers to maintain access even after the original compromised credentials were disabled. Microsoft said successful access did not necessarily mean that customer data had been stolen.

ARTEX was previously identified in attacks against South Korean financial institutions and Japanese companies. Japanese investigators found ARTEX on six overseas servers targeting approximately 80 businesses. Microsoft did not identify Storm-0940 as responsible for those earlier attacks.

Originally developed to help security professionals test computer systems for weaknesses, ARTEX uses AI to plan operations, direct other tools, and pursue different ways into a network with limited human intervention.

Microsoft said the automation allowed Storm-0940 to carry out operations simultaneously and exploit stolen credentials at high speed.

“The speed of the activity allows very little time for Defenders to respond to those alerts,” Microsoft’s researchers wrote.

Although most targeting attempts failed, Microsoft said the group established privileged access that could persist at many organizations. In some affected environments, attackers modified application credentials and permissions, potentially allowing unauthorized access to continue even after the original compromised application was secured.

Developer and Company Responses

The ARTEX creator, who uses the online name Autumn-27, condemned the tool’s misuse in an Oct. 8 public statement and denied involvement in the reported attacks. The developer announced that the project would stop receiving public updates and maintenance support and become closed-source.

Chinese cybersecurity company ThreatBook said in an Oct. 16 announcement that ARTEX originated as a personal project of its RedAgents product lead. The company acknowledged that the open-source version had been misused in major financial sector security incidents and lacked built-in security controls.

Microsoft acknowledged The Epoch Times’ inquiry but provided no additional comment. ThreatBook did not respond to a request for comment. The ARTEX developer could not be reached for comment.