A hacking group linked to China has exploited an AI-based autonomous penetration testing tool to breach the U.S. IT service provider ConnectWise, according to Microsoft. This AI tool has also been implicated in a series of hacking attacks targeting financial institutions and companies in South Korea and Japan, raising international concerns.
On October 21, Reuters reported that Microsoft identified the hacking organization, dubbed 'Storm-0940,' as utilizing the Chinese open-source AI penetration framework 'ARTEX' to attack ConnectWise and hundreds of other organizations worldwide.
Originally developed for system vulnerability assessments, ARTEX can autonomously conduct reconnaissance and data exfiltration by integrating various AI models, including large language models (LLMs). Attackers used ARTEX to impersonate trusted identities within the ConnectWise app, bypassing interactive login procedures to attempt access to multiple tenant organizations.
The targets spanned a wide range of sectors, including aerospace, defense, semiconductors, finance, government agencies, and think tanks.
While Microsoft managed to block most hacking attempts, it warned that Storm-0940 secured authorized access within just three hours, establishing cloud persistence across multiple organizations. ConnectWise is currently investigating unauthorized access attempts to its cloud backup environment.
ARTEX has also been identified as a key player in recent hacking incidents affecting financial institutions and companies in East Asia. Earlier this month, over 100,000 customer records were leaked from more than 16 financial companies in South Korea, with U.S. cybersecurity firms CrowdStrike and Recorded Future attributing the attacks to Chinese hackers using ARTEX.
In response to the escalating situation, the heads of South Korea's five major banks, who appeared at a National Assembly audit, pledged to enhance security investments, prevent recurrence, and provide compensation for victims.
Japanese companies have also fallen within ARTEX's reach. According to the Japanese IT media outlet ASCII, GMO Cybersecurity by Iera confirmed on October 19 that traces of ARTEX were detected on attack servers targeting Japanese firms, indicating that this AI tool has been misused in attacks against them as well.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.