Chinese-linked hackers compromise ConnectWise, target hundreds in global attack, Microsoft says
· CNA · JoinRead a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST
Oct 21 : A Chinese-linked hacking group used an AI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organizations globally, Microsoft said on Wednesday.
ConnectWise did not immediately respond to a request for comment on Microsoft's conclusions, although a statement posted to the company's website on October 16 said it was "investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment."
The Chinese Embassy in Washington did not immediately respond to a request for comment. Beijing regularly denies conducting or condoning cyber-enabled data theft.
The hackers, which Microsoft tracks as Storm-0940, used an open-source penetration testing framework called ARTEX to carry out the campaign, Microsoft said.
CNA Games
Guess Word
Crack the word, one row at a time
Buzzword
Create words using the given letters
Mini Sudoku
Tiny puzzle, mighty brain teaser
Mini Crossword
Small grid, big challenge
Word Search
Spot as many words as you can
Show More
Show Less
There are multiple tools used to conduct penetration testing, a form of legitimate testing of the security of networks or services. ARTEX allows users to use any AI model to automate a variety of penetration testing tasks and can be configured to run autonomous tasks including reconnaissance and data exfiltration, Microsoft said.
The attack targeted organizations across a wide variety of sectors, including aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and nonprofits, Microsoft said.
While the majority of the targeting was not successful, Microsoft said, Storm-0940 achieved privileged cloud persistence — or high-level access that could continue even after cleanup efforts — at many organizations in a brief time.
Newsletter
Week in Review
Subscribe to our Chief Editor’s Week in Review
Our chief editor shares analysis and picks of the week's biggest news every Saturday.
Sign up for our newsletters
Get our pick of top stories and thought-provoking articles in your inbox
Get the CNA app
Stay updated with notifications for breaking news and our best stories
Get WhatsApp alerts
Join our channel for the top reads for the day on your preferred chat app