微軟稱，與中國有關駭客入侵 ConnectWise，在全球攻擊中鎖定數百個目標

10 月 21 日（路透社）——微軟（Microsoft）週三表示，一個與中國政府立場一致的駭客組織使用 AI 驅動的滲透測試工具，入侵資訊服務公司 ConnectWise；這是一起鎖定全球數百個組織的攻擊行動的一部分。Oct 21 (Reuters) - A Chinese state-aligned hacking group used an AI-driven penetration testing tool to compromise IT services firm ConnectWise as part of a campaign that targeted hundreds of organizations globally, Microsoft said on Wednesday.

ConnectWise 執行長曼尼・里維洛（Manny Rivelo）在另一份聲明中表示，根據微軟的分析以及 ConnectWise 可取得的證據，「看來一個與中國政府立場一致的組織，應對 ConnectWise Cloud Backup 遭攻擊負責」。Based on Microsoft's analysis and evidence available to ConnectWise, "it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup," ConnectWise CEO Manny Rivelo said in a separate statement.

里維洛表示，ConnectWise「已控管受影響的應用程式連線，並正以受控階段恢復服務」；他並表示，「這些措施並不會移除可能已在個別客戶租戶內建立的未授權存取權，這些情況需要另行審查」。Rivelo said ConnectWise "contained the affected application connections and are restoring services in controlled phases," and that "those actions do not remove unauthorized access that may have already been established within individual customer tenants, which require separate review."

中國駐美大使館一名發言人表示，中國「依法反對並打擊駭客活動。同時，我們反對以網路安全問題為藉口，對中國進行抹黑和攻擊」。A spokesperson for the Chinese Embassy in Washington said China "opposes and fights hacking activities in accordance with the law. At the same time, we oppose smears and attacks against China under the excuse of cybersecurity issues."

微軟表示，該公司追蹤為 Storm-0940 的這批駭客，使用名為 ARTEX 的開源滲透測試框架執行這項攻擊行動。The hackers, which Microsoft tracks as Storm-0940, used an open-source penetration testing framework called ARTEX to carry out the campaign, Microsoft said.

滲透測試是對網路或服務安全性進行的合法測試形式，目前有多種工具可用於執行滲透測試。微軟表示，ARTEX 讓使用者能使用任何 AI 模型，自動化多種滲透測試任務，並可設定執行自主任務，包括偵察和資料外洩。There are multiple tools used to conduct penetration testing, a form of legitimate testing of the security of networks or services. ARTEX allows users to use any AI model to automate a variety of penetration testing tasks and can be configured to run autonomous tasks including reconnaissance and data exfiltration, Microsoft said.

微軟表示，這起攻擊鎖定多個領域的組織，包括航太、國防、汽車、化學、能源、金融服務、政府、法律、製造、媒體、軍事、半導體、軟體、科技、智庫和非營利組織。The attack targeted organizations across a variety of sectors, including aerospace, defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductor, software, technology, think tanks and non-profit organizations, Microsoft said.

微軟表示，雖然多數鎖定目標並未成功遭入侵，但 Storm-0940 在短時間內於許多組織取得具特權的雲端持續存取能力——也就是即使在清理作業後仍可能持續存在的高層級存取權。While the majority of targeting was not successful, Microsoft said, Storm-0940 achieved privileged cloud persistence — or high-level access that could continue even after cleanup efforts — at many organizations in a brief time.

（底特律 AJ Vicens 報導；Edmund Klamann 和 Christopher Cushing 編輯）(Reporting by AJ Vicens in Detroit; Editing by Edmund Klamann and Christopher Cushing)