Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says

A Chinese state-aligned hacking group used ​an AI-driven penetration testing tool ‌to compromise ​IT services firm ConnectWise as part of a campaign that targeted hundreds of organizations globally, Microsoft said on Wednesday.

Based on ‌Microsoft's analysis and evidence available to ConnectWise, "it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup," ConnectWise CEO Manny Rivelo said in a separate statement. Rivelo said ConnectWise "contained ‌the affected application connections and are restoring services in controlled phases," and that "those actions do ‌not remove unauthorized access that may have already been established within individual customer tenants, which require separate review."

A spokesperson for the Chinese Embassy in Washington said China "opposes and fights hacking activities in accordance with the law. At ⁠the same ​time, we oppose ⁠smears and attacks against China under the excuse of cybersecurity issues." The hackers, which Microsoft tracks as Storm-0940, used ⁠an open-source penetration testing framework called ARTEX to carry out the campaign, Microsoft said.

There are multiple tools used ​to conduct penetration testing, a form of legitimate testing of the security of networks or ⁠services. ARTEX allows users to use any AI model to automate a variety of penetration testing tasks and ⁠can ​be configured to run autonomous tasks including reconnaissance and data exfiltration, Microsoft said. The attack targeted organizations across a variety of sectors, including aerospace, defense, automotive, chemicals, energy, financial services, government, ⁠legal, manufacturing, media, military, semiconductor, software, technology, think tanks and non-profit organizations, Microsoft said.

While the majority of ⁠targeting was not ⁠successful, Microsoft said, Storm-0940 achieved privileged cloud persistence — or high-level access that could continue even after cleanup efforts — at many organizations in a ‌brief time.