Chinese hackers used AI to target thousands of cloud accounts via ConnectWise

Microsoft recently identified that a China-aligned espionage group, identified as Storm-0940, exploited a breach at IT vendor ConnectWise to target over 2,250 Microsoft 365 tenants. The attackers utilized compromised application credentials and an open-source AI penetration-testing tool known as ARTEX to automate their intrusion processes. This sophisticated approach allowed the group to move from initial targeting to obtaining privileged cloud access in under three hours in certain instances.

The incident forced ConnectWise to suspend its SaaS security, cloud management, and cloud backup services after detecting unauthorized access to application identities. This development highlights a significant shift in cyber threats, as the group integrated AI agents to accelerate their hacking capabilities. To mitigate risks, organizations are advised to immediately verify their exposure, apply necessary security patches, and bolster the protection of critical data and systems.