China-linked hackers exploit AI in campaign targeting IT firms globally

A coordinated cyber attack leveraging artificial intelligence has been attributed to a China-supported hacking collective, according to findings disclosed by Microsoft. The group has focused its efforts on compromising IT service companies, using them as vectors to infiltrate numerous organizations across multiple countries and sectors.

Connectwise, a major IT management platform provider, was identified as a primary target in the campaign. Security researchers indicate the attackers exploited vulnerabilities in widely-used software to gain unauthorized access, potentially compromising numerous downstream clients who rely on these platforms for their operations.

The integration of artificial intelligence tools in the attack marks an escalation in cyber warfare tactics, enabling attackers to automate reconnaissance, identify vulnerabilities, and scale their operations more efficiently. The campaign represents a significant threat to organizations across South and Southeast Asia, where many businesses depend on IT service providers for critical infrastructure management.

Microsoft's disclosure underscores growing concerns about state-sponsored cyber operations targeting the digital supply chain. Security experts recommend organizations review their vendor relationships, implement enhanced monitoring protocols, and update security systems to detect suspicious activities indicative of compromise through third-party service providers.