AI takes cybercrime to new level as China-linked hackers target thousands of cloud systems

A China-linked hacking group allegedly deployed an artificial intelligence-powered security tool to launch large-scale cyberattacks targeting more than 2,250 cloud environments worldwide, raising concerns over the growing use of AI to accelerate sophisticated cyber intrusions.

The operation, attributed to a group identified as Storm-0940, involved the misuse of compromised credentials linked to the Cloud Backup application of US technology firm ConnectWise, according to a report by The Epoch Times, citing findings released by Microsoft on October 21.

Microsoft, which has monitored Storm-0940 since 2021, found that the attackers exploited credentials associated with ConnectWise's cloud backup service, potentially allowing them to gain access through applications already authorised by customers using Microsoft's cloud infrastructure.

The hackers reportedly used ARTEX, a Chinese-developed AI-powered security testing tool, to automate vulnerability scanning, password attacks and the exploitation of application permissions.

Government agencies, defence contractors, financial institutions, technology companies and other organisations were among the targets of the campaign.

Over 2,250 cloud environments targeted

According to the report, Storm-0940 attempted to infiltrate more than 2,250 customer cloud environments by exploiting compromised ConnectWise applications.

However, Microsoft clarified that the figure represented attempted intrusions and did not indicate that all the targeted environments had been successfully breached.

In some instances, the attackers reportedly secured privileged access to cloud infrastructure within three hours of beginning their operations.

Microsoft's investigation revealed that the hackers examined cloud resources, altered application credentials and attempted to modify access permissions.

Such modifications could potentially allow attackers to retain unauthorised access even after the initially compromised credentials were revoked.

The technology giant, however, stressed that gaining access to a cloud environment did not necessarily establish that customer information had been stolen.

ConnectWise confirms unauthorised access

ConnectWise acknowledged that credentials associated with its Cloud Backup service, previously known as SkyKick, had been accessed without authorisation.

In an update issued on October 25, the company said its existing backup archives remained encrypted, isolated and intact, with no indication that the stored data had been compromised.

It also maintained that there was no evidence suggesting that the security incident had affected other ConnectWise products or services.

The breach disrupted access to Cloud Backup, prompting the company to launch an investigation and begin restoration procedures.

ConnectWise planned to allow partners to restore information from existing backups beginning October 26, with customer re-enrolment to follow in phases.

Customers were advised not to reactivate affected application connections until they received official restoration instructions. They were also urged to examine their Microsoft 365 environments for signs of suspicious activity.

AI tool accelerates hacking operations

ARTEX was originally designed as an AI-assisted security testing platform to help cybersecurity professionals identify weaknesses in computer networks and applications.

However, the tool's capabilities were allegedly exploited by cybercriminals to automate several stages of an attack.

Unlike conventional hacking tools that require extensive manual intervention, ARTEX can reportedly plan operations, coordinate other tools and explore potential entry points into targeted systems with limited human involvement.

Microsoft said the technology enabled Storm-0940 to carry out multiple operations simultaneously and rapidly exploit compromised credentials.

Researchers warned that the speed of these AI-assisted intrusions significantly reduced the time available for security teams to identify suspicious activity and respond before attackers gained deeper access.

Earlier attacks in Japan and South Korea

The report also linked ARTEX to previous cyber incidents involving financial institutions in South Korea and businesses in Japan.

Japanese investigators reportedly discovered the tool operating on six overseas servers that were targeting approximately 80 companies.

However, Microsoft did not establish a connection between Storm-0940 and those earlier incidents.

The growing use of AI-assisted hacking tools has raised concerns that technologies originally developed for legitimate security assessments could be repurposed to conduct cyberattacks at greater speed and scale.

Developer condemns misuse

According to The Epoch Times, ARTEX creator Autumn-27 issued a statement on October 8 condemning the misuse of the tool and denying any involvement in the reported attacks.

The developer also announced that public updates and maintenance of ARTEX would be discontinued.

Meanwhile, Chinese cybersecurity firm ThreatBook said on October 16 that ARTEX had initially been developed as a personal project by the lead of its RedAgents product.

The company acknowledged that the open-source version had been misused in significant financial-sector security incidents and admitted that the tool lacked built-in security safeguards.

The Epoch Times said it had approached ThreatBook, Microsoft and ConnectWise for additional comments but had not received responses by the time its report was published.