AI-Powered Hackers Breach IT Firm, Targeting Hundreds Globally

A Chinese-linked hacking group, identified by Microsoft as Storm-0940, has successfully compromised IT services firm ConnectWise. This breach was part of a broader campaign that aimed to infiltrate hundreds of organizations across the globe. The attackers employed an advanced, open-source penetration testing framework named ARTEX, which uniquely utilizes artificial intelligence to automate critical cyberattack functions.

ARTEX is capable of configuring autonomous tasks, including initial reconnaissance of potential targets and subsequent data exfiltration. This AI-driven approach allowed Storm-0940 to achieve significant success, particularly in gaining privileged cloud persistence at many targeted organizations. This high-level access could remain even after initial cleanup efforts, posing a persistent threat.

The cyberattack campaign was extensive, impacting organizations across diverse sectors such as aerospace, defense, finance, government, and technology. Despite the broad reach, Microsoft indicated that the majority of these targeted attacks were not successful in achieving their ultimate goals. However, the breach at ConnectWise highlights a growing trend of sophisticated, AI-assisted cyber threats originating from state-sponsored groups.