Beijing [China], October 26 (ANI): A China-aligned hacking group used an artificial intelligence (AI) tool to accelerate cyberattacks against hundreds of organisations worldwide, including an incident involving US technology company ConnectWise, according to a report by The Epoch Times (TET).

Citing findings published by Microsoft on October 21, the report said the hacking group Storm-0940, which Microsoft has tracked since 2021, compromised credentials associated with ConnectWise's Cloud Backup application. The stolen credentials potentially enabled attackers to exploit access already authorised by customers using Microsoft's cloud services.

The group reportedly used ARTEX, a Chinese-developed AI security-testing tool, to automate scanning, password attempts and exploitation of application permissions. Its targets included government agencies, defence contractors, financial institutions, technology companies and other organisations.

According to the TET report, Storm-0940 attempted to access more than 2,250 customer cloud environments through compromised ConnectWise applications. Microsoft clarified that this figure represented attempted access, not confirmed breaches.

In several cases, the attackers obtained privileged access to cloud systems in less than three hours after initial targeting. Microsoft observed the group examining cloud resources, modifying application credentials and attempting to change permissions.

Such changes could allow unauthorised access to persist even after the original compromised credentials were disabled. However, Microsoft noted that successful access did not necessarily mean customer data had been stolen.

ConnectWise confirmed unauthorised access to credentials associated with its Cloud Backup service, formerly known as SkyKick. In an October 25 update, the company said existing backup archives remained encrypted, isolated and preserved, with no indication they had been compromised. It also reported no evidence that other ConnectWise products or services were affected.

The incident disrupted access to Cloud Backup while investigations and restoration work continued. ConnectWise planned to begin allowing partners to restore data from existing backups on October 26, followed by phased re-enrolment. Customers were advised to keep affected application connections disabled until restoration instructions arrived and to check their Microsoft 365 environments for suspicious activity.

As cited by TET, ARTEX was originally developed to help security professionals identify weaknesses in computer systems. The tool uses AI to plan operations, direct other tools and pursue different ways into networks with limited human intervention.

Microsoft said the automation enabled Storm-0940 to conduct operations simultaneously and exploit stolen credentials rapidly. Its researchers warned that the speed of the activity left defenders with very little time to respond to alerts.

The report noted that ARTEX had previously been identified in attacks involving South Korean financial institutions and Japanese companies. Japanese investigators reportedly found the tool on six overseas servers targeting approximately 80 businesses. Microsoft did not attribute those earlier attacks to Storm-0940.

According to TET, ARTEX creator Autumn-27 condemned the tool's misuse in an October 8 statement, denied involvement in the reported attacks and announced that public updates and maintenance would end.

Chinese cybersecurity company ThreatBook said on October 16 that ARTEX began as a personal project by its RedAgents product lead. The company acknowledged misuse of the open-source version in major financial-sector security incidents and said it lacked built-in security controls.

TET reported that it contacted ThreatBook, Microsoft and ConnectWise for further comment, but none had responded by publication time. (ANI)