Chinese Hacking Group Targets Global Firms via ConnectWise

A Chinese state-aligned hacking group known as Storm-0940 compromised the IT services firm ConnectWise to target hundreds of organizations worldwide. The attackers utilized ARTEX, an open-source AI-driven penetration testing framework, to automate reconnaissance and data exfiltration across the defense, aerospace, government, financial services, and energy sectors.

Microsoft analyzed the campaign and found that while most targeting attempts failed, the group successfully achieved privileged cloud persistence at several organizations. This high-level access may remain active even after initial cleanup efforts are completed.

ConnectWise CEO Manny Rivelo confirmed that a China state-aligned group was likely responsible for the breach of the company's Cloud Backup service. Rivelo stated that the firm has contained affected application connections and is restoring services in controlled phases. However, he warned that individual customer tenants require separate reviews to remove unauthorized access that may have already been established.