The key facts

  • According to Microsoft, the Storm-0940 group has been operating since 2021 and used the open-source AI framework ARTEX to automate attacks.
  • Attack speeds reached nearly 3,000 login attempts per minute; in some cases access to cloud systems was gained in under three hours.
  • ConnectWise disabled the affected connections and is restoring the service in stages; the credential leak mechanism remains under investigation.

AI-powered attack

On Wednesday, October 22, Microsoft reported that a hacker group linked to the Chinese state used an AI-based security testing tool in a campaign in which the IT company ConnectWise was compromised. The attack targeted hundreds of organizations worldwide, including government agencies, the defense sector, energy, financial services, and technology companies. Microsoft links the activity to the Storm-0940 group, which, according to the company, has been operating since 2021.

The role of ARTEX and the scale of the attacks

The attackers used ARTEX — an open-source penetration testing framework that can be connected to AI models to automate tasks, from finding vulnerabilities to stealing data. Although penetration testing is normally used to assess security, Microsoft said the attackers used the framework to speed up their operations. According to TechCrunch, citing Microsoft, using AI agents the hackers breached about 2,250 organizations at a rate of nearly 3,000 login attempts per minute; such speed, Microsoft noted, leaves defenders 'little time to detect and respond.' In some cases, the attackers gained high-level access to cloud systems less than three hours after selecting a target. Most attempts failed, but the group established a foothold in many organizations. Microsoft clarified that successful logins did not necessarily mean access to customer data or its theft. According to TechCrunch, the same AI tool was recently used in the compromise of South Korea's financial systems, many of which had weak protection and did not use multi-factor authentication.

Breach mechanism and ConnectWise's response

According to Microsoft, the hackers broke into ConnectWise's cloud backup service (Cloud Backup, formerly known as SkyKick) and stole application credentials used for communication between ConnectWise and its corporate clients. Using them, the attackers could log into clients' Microsoft environments as authorized users and gain access to email and files. ConnectWise said its data, including Microsoft intelligence, points to the involvement of a China state-linked group in the attack on Cloud Backup. The company disabled the affected application connections and began a phased restoration of services after security checks. However, it warned that these measures will not eliminate potential unauthorized access within individual client Microsoft 365 environments, which require separate investigation. In an update on Thursday, ConnectWise said restoration would take several days, and existing backup archives remain encrypted, isolated, and preserved, with no signs of compromise. The company urged clients to keep the affected connections disabled until official reconnection instructions are issued.

Unresolved questions and China's position

ConnectWise said the initial mechanism of the credential leak remains under investigation; it has not yet been possible to determine whether a product vulnerability contributed to the incident. The Chinese Embassy in Washington rejected the accusations against Beijing, stating that China opposes hacking and considers such accusations attempts to smear the country.