Microsoft says a China-linked hacking group used AI tools to carry out the recent breach at IT software firm ConnectWise, according to The Register and The Record.

Microsoft calls the group Storm-0940, the outlets reported. It has been active since at least 2021 and usually steals data, The Record said.

The group used an open-source AI hacking tool called ARTEX, The Register and The Record reported. The tool was built for authorized security testing. It runs a team of AI agents that can carry out an attack with little human help, The Record said.

ConnectWise shut down three cloud services after it found the breach, The Register reported.

Using stolen ConnectWise app credentials, the hackers tried to get into more than 2,250 Microsoft 365 customer accounts, The Register said. At times they made 2,900 attempts a minute, the outlets reported.

In some cases, the hackers went from picking a target to gaining high-level access in under three hours, The Register and The Record reported. Most attempts failed, but the hackers kept access at many groups, Microsoft said, according to the outlets.

Since September, the group has gone after targets in government, defense, banking, factories and tech, the outlets reported.

Microsoft has not said how many customers were breached or whether data was stolen, The Register reported.

ConnectWise CEO Manny Rivelo said the company had contained the affected connections and was slowly restoring services, The Register said.

The developer of ARTEX said on GitHub that the tool was abused and that it would no longer be updated, The Record reported. Microsoft says attackers in several regions have used the tool, The Register said.

"Agents are not constrained by factors affecting humans," Microsoft said, according to The Record. They can work around the clock and try many paths at once, it said.

What we know: Microsoft blames Storm-0940, which used AI agents to speed up its attacks.
What we don't: How many customers were breached, and whether any data was taken.