[Edaily Reporter Kim Kyeo-Re ] It has been revealed that a hacking group linked to the Chinese government used “Artex,” an artificial intelligence (AI) tool previously employed in hacks against South Korean banks, to compromise a U.S. information technology (IT) services company and launch attacks on hundreds of organizations worldwide. The group reportedly gained high-level cloud access privileges at some of these organizations—privileges that could persist even after security measures were implemented.

According to Reuters on the 21st (local time), Microsoft (MS) stated that “Storm-0940,” a hacking group linked to the Chinese government, infiltrated the U.S. IT services provider ConnectWise and used it to target hundreds of organizations worldwide.
The hackers used ConnectWise’s cloud backup service as a point of entry. ConnectWise is a provider of remote IT management and backup services to corporate clients, and this attack constitutes a so-called “supply chain attack,” in which attackers infiltrate client companies via their service providers.
Manny Rivello, CEO of ConnectWise, stated in a press release, “Based on a combination of Microsoft’s analysis and evidence gathered by our company, it appears that an organization linked to the Chinese government carried out the attack.” He explained, “We are blocking connections to affected applications and gradually restoring services,” but added, “These measures alone do not eliminate unauthorized access that may have already been gained to individual customers’ cloud environments.”
According to Microsoft, the hackers used a Chinese AI-based penetration testing tool called “Artex” in the attack. Artex is a tool designed to connect various AI models to automatically perform tasks ranging from identifying system vulnerabilities to exfiltrating information; it was also recently used in hacking attacks targeting the South Korean financial sector.
In a report released on the 7th, the U.S. cybersecurity firm CrowdStrike revealed that hackers, believed to be Chinese-speaking, used Artex and several AI models to attack South Korean financial institutions and steal data. At the time, major domestic banks—including Shinhan Bank, KB Kookmin Bank, and Hana Bank—suffered a series of cyberattacks, prompting financial authorities to launch an investigation. However, it has not been confirmed whether the attacks on South Korean financial institutions and this global hacking incident were carried out by the same group.
The targets of this attack spanned a wide range of sectors, including aerospace, defense, automotive, chemicals, energy, financial services, government, law, manufacturing, media, military, semiconductors, software, technology, and nonprofit organizations. Microsoft stated that the majority of the attack attempts failed.
However, the company explained that hackers succeeded in gaining administrator-level access to the cloud environments of numerous organizations within a short period and in maintaining that access continuously. This means that even if affected organizations carry out security remediation, the access privileges secured by the attackers may remain, potentially leading to further breaches.