Microsoft. [Reuters]
Microsoft. [Reuters]

A China-linked hacking group used an AI-based penetration-testing tool to breach ConnectWise, a US IT services firm, Microsoft said Wednesday (local time), adding that the same tool was used in attacks that exposed personal data held by South Korean financial institutions.

According to Reuters, Microsoft said the group, which it has named Storm-0940, used ARTEX — a Chinese-developed open-source AI penetration-testing tool — to attack ConnectWise as part of a campaign targeting hundreds of organizations worldwide. ARTEX is a framework designed to diagnose system vulnerabilities. It can work with any AI model to automate tasks and can be configured to carry out operations such as reconnaissance and data exfiltration autonomously.

Microsoft said the group began using ARTEX as early as September and, from Oct. 10 to 14, attempted password-spraying attacks against 327 accounts across eight organizations, generating more than 151,000 failed login attempts without successfully authenticating.

Microsoft also cited reports that ARTEX was used in attacks connected to a personal data breach targeting South Korean financial institutions. More than 100,000 records have been confirmed leaked from at least 16 financial firms in South Korea since earlier this month.

US cybersecurity firms Recorded Future and CrowdStrike attributed the incident to Chinese-speaking threat actors who used ARTEX alongside multiple AI models.

According to Microsoft, the attackers exploited ConnectWise's trusted application identity to bypass authentication without an interactive login.

ConnectWise is a managed service provider that handles IT operations for small and medium-sized enterprises. The hacker group is believed to have sought access to multiple tenants — subscriber organization units — through the trusted app identity rather than breaching individual companies one by one. Targets spanned a wide range of sectors, including aerospace, defense, automotive, chemicals, energy, finance, government, legal, semiconductors, software and think tanks.

Microsoft said most of the attacks were unsuccessful, but that Storm-0940 did establish "privileged cloud persistence" across multiple organizations in a short period of time. In some cases, the group gained privileged access within three hours of initially targeting an organization.

In a statement Friday, ConnectWise said it was "investigating recent unauthorized access attempts related to our cloud backup environment."


yckim6452@heraldcorp.com