The National Cyber Security Centre, an arm of GCHQ, is understood to be working with Microsoft and others to understand whether British organisations have been compromised by attacks from a group called “Storm-0940”.

Microsoft last week uncovered a global campaign by the “China-state-aligned” hackers to target hundreds of organisations around the world using AI.

Sensitive industries, including defence, energy, finance, government and technology, were among those targeted, Microsoft said.

ConnectWise, an American company, was compromised as part of the attack. Its cloud service is used by major organisations to help back-up Microsoft 365 email and files.

ConnectWise has notified Britain’s data watchdog about a breach, which the Information Commissioner’s Office is assessing.

The supply-chain attack forced ConnectWise to suspend its services. The company said there was no sign that stored backups had been compromised, but warned that switching off its service would not remove any access the attackers had already gained to customers’ systems.

Manny Rivelo, the chief executive of ConnectWise, said: “We contained the affected application connections and are restoring services in controlled phases.

“Those actions do not remove unauthorised access that may already have been established within individual customer tenants, which require separate review.”

Microsoft said the China-linked hackers had been using AI to launch attacks since at least September and had successfully gained access to the cloud infrastructure of a number of organisations, sometimes in less than three hours.

“AI Agents are not constrained by factors affecting humans – they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously enabling significantly reduced time from selecting a target to achieving objectives, increasing the speed and impact of complex attacks,” security researchers wrote.

It comes amid a barrage of AI-boosted hacking attempts over the past week. Websites around the world have been hit by millions of hacking attempts after AI agents discovered a vulnerability in PHP, a coding language.

The programming language underpins about 70pc of the world’s websites, and the flaw led governments and companies to pull their websites off the internet before they could be attacked, and so they could patch the fault.

Experts said the vulnerability was only able to be attacked using AI, raising fears that the technology would uncover a host of other ways to hack the internet, critical infrastructure and companies.

Jason Clinton, Anthropic’s deputy chief information security officer, warned on Friday that cyber security issues were “going to get a lot worse before they get better”.

The Chinese state-aligned group behind the recent hacking campaign had been using a piece of software called Artex to supercharge their hacking attempts.

The programme was released publicly in July by a Chinese developer as “open source” software, meaning it was available to download and modify for free.

It works by connecting existing hacking tools to AI agents. All a user has to do is direct the agents towards a specific target, give it a goal and then it will autonomously attempt to hack the target using all methods it can find.

“Basically what it’s doing is speeding up what human penetration testers did and making that process much shorter,” Prof Alan Woodward, a specialist in computer science and cyber security at Surrey University, said.

“It looks like the Artex tool was being used by these Chinese state live actors to do exactly that, they were probing all sorts of systems.”

Source link