Microsoft says Chinese linked hackers used an AI penetration testing tool to compromise ConnectWise and target hundreds of organizations

The tool was built for defenders. Penetration testing frameworks exist so security teams can probe their own networks for weak points before criminals find them. Microsoft said on Wednesday that a Chinese linked group it tracks as Storm 0940 took an open source framework called ARTEX, which can plug in any artificial intelligence model to automate tasks such as reconnaissance and data theft, and turned it on hundreds of organizations worldwide.

The entry point, Microsoft said, was ConnectWise, a company whose software helps IT firms manage their clients' systems. ConnectWise posted a statement on October 16 saying it was "investigating recent attempts of unauthorized access associated with the ConnectWise Cloud Backup environment." The company did not immediately respond to questions about Microsoft's findings on Wednesday. The Chinese Embassy in Washington did not immediately respond either. Beijing regularly denies carrying out or condoning cyber theft.

The target list ran across the economy: aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software and technology firms, along with think tanks and nonprofits, Microsoft said. Most of the attempts did not succeed. The ones that mattered did. Microsoft said Storm 0940 achieved privileged cloud persistence at many organizations in a brief time, meaning a level of access high enough that it could remain in place even after the victims cleaned their systems, as of October 21.