AI-Powered Chaos: China-Aligned Hackers Target 2,250+ Cloud Environments
Hacking group Storm-0940 used the ARTEX AI tool to target thousands of cloud environments, including US firm ConnectWise.
In a sophisticated display of cyber warfare, a hacking group aligned with China has deployed an artificial intelligence (AI) tool to launch rapid-fire attacks against over 2,250 cloud environments across the globe. The group, identified by Microsoft as Storm-0940, targeted a wide array of high-value entities, including government agencies, financial institutions, defense contractors, and technology firms.
The ConnectWise Breach and Cloud Exploitation
At the center of this operation was a security breach involving the US-based technology company ConnectWise. According to reports citing Microsoft's findings, Storm-0940 managed to compromise credentials linked to ConnectWise’s Cloud Backup application (previously known as SkyKick).
By stealing these credentials, the attackers were able to exploit access that customers had already authorized within Microsoft’s cloud services. This created a dangerous "backdoor" that allowed the hackers to bypass traditional security perimeters.
ARTEX: The AI Engine Driving the Attacks
The scale and speed of these attacks were made possible by ARTEX, a Chinese-developed AI security-testing tool. While originally designed to help security professionals find vulnerabilities, the hackers repurposed it for malicious automation. ARTEX allowed the group to:
- Automate the scanning of targets.
- Execute rapid password attempts.
- Exploit application permissions with minimal human intervention.
Microsoft researchers warned that this level of automation enabled Storm-0940 to conduct multiple operations simultaneously. In some instances, the hackers gained privileged access to cloud systems in less than three hours after the initial targeting, leaving defenders with almost no time to react to alerts.
The Scope of the Damage
While the report mentions that Storm-0940 attempted to access more than 2,250 customer cloud environments, Microsoft clarified that these were attempted accesses rather than confirmed breaches. However, the activity observed was alarming. The group was seen:
- Examining cloud resources.
- Modifying application credentials.
- Changing permissions to ensure their access persisted even if the original stolen credentials were disabled.
Despite these intrusions, Microsoft noted that successful access does not automatically mean that customer data was stolen.
ConnectWise Responds
ConnectWise has confirmed the unauthorized access to credentials associated with its Cloud Backup service. In an update provided on October 25, the company reassured users that existing backup archives remained encrypted, isolated, and preserved, with no evidence of compromise. Furthermore, there is no indication that other ConnectWise products were affected.
The incident led to a temporary disruption of the Cloud Backup service. The company began a phased restoration process on October 26, advising customers to keep affected application connections disabled until official instructions were received and to monitor their Microsoft 365 environments for any suspicious activity.
The Controversial Origins of ARTEX
The tool at the heart of the crisis, ARTEX, has a murky history. It was reportedly started as a personal project by the RedAgents product lead at the Chinese cybersecurity firm ThreatBook. The company acknowledged that the open-source version of the tool lacked built-in security controls, making it susceptible to misuse in major financial-sector security incidents.
The creator of ARTEX, known as Autumn-27, issued a statement on October 8 condemning the misuse of the tool and denying any involvement in the attacks. Consequently, it was announced that all public updates and maintenance for the tool would cease.
A Pattern of Global Targeting
This is not the first time ARTEX has appeared in cyber-intelligence reports. The tool was previously identified in attacks targeting Japanese companies and South Korean financial institutions. In Japan, investigators discovered the tool on six overseas servers used to target approximately 80 businesses, though Microsoft did not specifically attribute those earlier events to Storm-0940.