Chinese hackers used AI tools to breach ConnectWise and hundreds of firms

The ARTEX AI Framework

Microsoft recently identified a cyberattack campaign involving a China state-aligned hacking group known as Storm-0940. This group utilized a specific open-source AI framework called ARTEX to conduct their operations. ARTEX is a penetration testing tool, which is software designed to simulate cyberattacks to find vulnerabilities in a network.

What makes ARTEX notable is its ability to support multiple AI models to automate complex security tasks. Instead of a human hacker manually typing every command, the tool can be configured to perform autonomous operations. These include reconnaissance, which is the process of gathering information about a target, and data exfiltration, the act of moving stolen data out of a private network.

By using AI to automate these steps, the hackers could potentially conduct more sophisticated attacks at a faster pace than traditional manual methods. This allows a single group to maintain a high volume of activity across many different targets simultaneously.

The ConnectWise Supply Chain

The primary target of this campaign was ConnectWise, a major IT services provider. Because ConnectWise manages IT services for many other companies, it serves as a high-value target in what security experts call a supply-chain attack. In this scenario, hackers breach one trusted provider to gain a 'backdoor' into all of that provider's customers.

ConnectWise CEO Manny Rivelo confirmed that the incident targeted the ConnectWise Cloud Backup service. The hackers aimed to exploit the trusted connections between the service provider and its clients. By compromising the provider, the group could potentially reach customer environments without having to attack each individual company one by one.

Microsoft reported that the campaign reached hundreds of organizations across various industries. While the majority of the attack attempts were unsuccessful, the group managed to establish persistent, privileged cloud access at several organizations in a very short amount of time. Privileged access refers to high-level permissions that allow an intruder to make significant changes to a system or view sensitive data.

Recovery and lingering risks

ConnectWise has taken steps to contain the damage by shutting down affected application connections. The company is currently restoring its services in controlled phases to ensure stability. However, the company issued a stern warning to its clients regarding the nature of the breach. They noted that simply restoring the service does not mean the hackers are gone.

Because the attackers established persistent access, they may have already created hidden accounts or backdoors within the customer environments. ConnectWise stated that affected organizations must perform their own internal investigations. They need to identify any compromised accounts and manually remove the remaining unauthorized access that the hackers may have left behind.

The Chinese Embassy in Washington rejected the allegations of involvement, stating that China opposes hacking activities. Despite the denial, the technical evidence provided by Microsoft points toward the state-aligned group Storm-0940. This incident serves as a reminder of how AI can be used to amplify the reach of traditional hacking techniques.

The shift toward AI automation

This breach highlights a growing trend in cybersecurity where attackers combine AI-powered tools with supply-chain vulnerabilities. By using a framework like ARTEX, hackers can automate the most tedious parts of a cyberattack, such as scanning for open ports or identifying weak points in a network. This allows them to focus their energy on the most valuable targets while the AI handles the heavy lifting of the initial breach.

For organizations, this means that traditional security perimeters may no longer be enough. If a trusted third-party service provider is compromised, the automated tools used by hackers can quickly move laterally into the customer's private infrastructure. Security teams are now being forced to look beyond their own walls and scrutinize the security practices of every vendor they use to manage their data.