Microsoft says China-linked hackers breached ConnectWise, with global attacks targeting hundreds of organizations

Microsoft says a China state-linked hacking group it tracks as Storm-0940 used an AI-driven open-source penetration testing framework called ARTEX to breach IT services company ConnectWise, in a campaign targeting hundreds of organizations worldwide. Microsoft says ARTEX can call on any AI model to automate penetration testing tasks and can be configured to autonomously carry out reconnaissance and data exfiltration. Targeted sectors include aerospace, defense, energy, finance, government, military, semiconductors, think tanks and nonprofits; Microsoft says most targeted attacks were unsuccessful, but that Storm-0940 achieved privileged cloud persistent access at many organizations in a short time, meaning advanced permissions that may survive cleanup. ConnectWise CEO Manny Rivelo said that based on Microsoft's analysis and existing evidence, it appears a China state-linked group attacked ConnectWise Cloud Backup; the company has contained the affected application connections and is restoring service in stages, but this cannot remove unauthorized access that may already have been established within individual customer tenants, which requires separate review.