Microsoft Says Chinese Hackers Used AI to Breach ConnectWise

Microsoft says a China state-aligned hacking group used an AI-powered penetration testing tool to compromise IT services provider ConnectWise and target hundreds of organizations worldwide.

The group, which Microsoft tracks as Storm-0940, used an open-source AI framework called ARTEX to conduct the supply-chain campaign.

According to Microsoft’s security report, most attack attempts failed. However, the hackers successfully established persistent privileged cloud access at numerous organizations.

The Chinese Embassy in Washington rejected the allegations, saying China opposes hacking activities.

Hackers used AI to automate cyberattacks

Storm-0940 used ARTEX, an open-source penetration testing framework that supports multiple AI models and automates security testing tasks.

Microsoft explained that attackers can configure the tool to perform autonomous operations, including reconnaissance and data exfiltration.

The campaign targeted organizations across multiple industries, allowing attackers to exploit trusted IT service connections to reach customer environments.

Despite the high failure rate, Microsoft says the group established privileged cloud persistence at multiple organizations within a relatively short period.

ConnectWise confirms attack and begins recovery

ConnectWise CEO Manny Rivelo acknowledged the security incident and said available evidence points to a China state-aligned group targeting the company’s ConnectWise Cloud Backup service.

The company has contained affected application connections and started restoring services in controlled phases.

However, ConnectWise warned that restoring its services does not automatically eliminate unauthorized access that attackers may have already established within customer environments.

Affected organizations must investigate their own systems, identify compromised accounts and remove any remaining unauthorized access.

The incident highlights how attackers can combine AI-powered tools with supply-chain compromises to target multiple organizations through a single IT service provider.

In other security news, Google Cloud warned about critical PHP vulnerabilities affecting millions of websites, while Microsoft introduced plans for Guardian Agents to address AI security threats.