Chinese-linked hackers exploit AI pen-test tool to breach ConnectWise and dozens of global firms

Microsoft identified a campaign by the Chinese-linked hacking group Storm-0940 that leveraged the AI-enabled penetration-testing tool ARTEX to breach the IT services provider ConnectWise. The attackers obtained privileged cloud persistence, allowing continued access even after cleanup, at a wide array of organizations spanning aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and nonprofits.

ConnectWise said it was investigating recent unauthorized access attempts on its Cloud Backup environment, but did not comment further on Microsoft’s findings. The Chinese Embassy in Washington declined to comment on the allegations. Beijing typically denies involvement in cyber-enabled data theft. Microsoft highlighted that while most targeting attempts failed, the successful compromises demonstrate the risk posed by AI-augmented hacking tools.