A hacking group aligned with the Chinese state turned an AI-driven security testing tool against ConnectWise, using the breach as part of a wider operation that went after hundreds of organisations worldwide, Microsoft said on Wednesday, Reuters reported. ConnectWise is an IT services company. Microsoft has published its findings in a security blog post.
The firm's chief executive, Manny Rivelo, said in his own statement that Microsoft's findings and the evidence ConnectWise had reviewed pointed to the same conclusion: “It appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup.”
According to Rivelo, ConnectWise has isolated the affected application connections and is restoring its services step by step. But he cautioned that this does not undo any unauthorised access the attackers may already have gained inside individual customers' environments, which will each need to be reviewed on their own. The incident highlights how a breach at a single service provider can have knock-on effects for many of its customers.
ALSO READ | Microsoft Expands Sovereign Cloud Capabilities, Adds EU Data Oversight
China Denies Involvement
China has pushed back. A spokesperson for its embassy in Washington said the country “opposes and fights hacking activities in accordance with the law,” while also opposing “smears and attacks against China under the excuse of cybersecurity issues.”
Microsoft refers to the hackers as Storm-0940. The group carried out the campaign using ARTEX, an open-source framework designed for penetration testing.
Penetration testing is normally used by companies for good reasons, as a way of checking how secure their networks and services are. What makes ARTEX different, Microsoft said, is that it can work with any AI model to automate testing jobs. It can even be configured to run tasks with little human input, such as mapping out a target and pulling data out of a network. The case shows how AI tools built for defenders can also be turned against them.
ALSO RAED | Microsoft Bets On In-House Maia Chips for AI From 2027 To Loosen Nvidia's Grip
A Long List of Targets
The list of targets was long and varied. Microsoft said organisations in defence, the military, aerospace and government were targeted, along with companies in energy, finance, manufacturing, cars, chemicals, chips, software and technology. Law firms, media outlets, think tanks and non-profits were also on the list.
Most of the break-in attempts did not succeed, according to Microsoft. Even so, the group quickly gained high-level access to cloud environments at many organisations. That kind of access is especially worrying because it can remain in place even after a company tries to clean up its systems.
Essential Business Intelligence, Sharp Market Insights, Practical Personal Finance Advice, Daily Fuel, Gold and Silver Prices and Latest Stories — On NDTV Profit.