Chinese-linked hackers use AI to compromise firms globally: Microsoft

The technology giant Microsoft said a hacking group linked to the Chinese government used an artificial intelligence (AI) tool for testing computer security to break into IT services company ConnectWise. The attack was part of a campaign that targeted hundreds of organisations around the world.

In a blog post published on Wednesday, the American technology company said the attack on ConnectWise's Cloud Backup service was carried out by Storm-0940, a group Microsoft has tracked since 2021.

"The campaign targeted organisations across sectors, including aerospace, defence, energy, financial services, government, manufacturing, semiconductors and technology," Microsoft said.

The group used ARTEX, a free, open-source tool for testing computer security that uses AI models to automate security tasks. Microsoft said the tool helped the attackers work faster when scanning systems for weaknesses, gathering information about targets, trying many passwords against accounts, and misusing OAuth applications to gain access to customers' computer systems.

Microsoft said Storm-0940 tried to sign in to more than 2,250 customer accounts, known as tenants, at a rate of 2,900 sign-in attempts per minute.

Between October 10 and 14, the group targeted 327 accounts across eight organisations and made more than 151,000 unsuccessful login attempts, Microsoft said.

Microsoft said some attacks allowed the group to gain high-level access to cloud systems in less than three hours. However, most of the attempts to target organisations failed.

Microsoft also said the activity was not caused by a breach of, or a weakness in, its own company systems, products or services. It warned that even when attackers successfully signed in, this did not necessarily mean they had viewed or stolen customer data.

"Although Microsoft identified Storm-0940-initiated authentication and follow-on activity in multiple customer environments, the presence of an affected application or successful threat actor authentication does not necessarily indicate that customer data was accessed or exfiltrated," it said.

The news agency Reuters reported that ConnectWise CEO Manny Rivelo said the company's review, based on Microsoft's analysis and evidence available to ConnectWise, indicated that "a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup".

Rivelo said the company had "contained the affected application connections and are restoring services in controlled phases".

He also warned that these steps could not remove any unauthorised access that attackers might already have gained inside individual customers' systems. Each customer would need a separate review to check for such access, Reuters reported.

ConnectWise began bringing its services back in stages after temporarily shutting them down following the attack, CyberScoop reported. The company told customers to keep connections turned off while recovery work continued.

A spokesperson for the Chinese Embassy in Washington rejected the claims, saying China "opposes and fights hacking activities in accordance with the law," Reuters reported. The spokesperson added that Beijing opposed "smears and attacks against China under the excuse of cybersecurity issues."

In its blog post, Microsoft said the incident showed how attackers were using AI agents to automate existing hacking methods and try to break into several organisations more quickly. The company also said it had found attackers from different regions using ARTEX to improve their capabilities.