China state-aligned hackers spied on thousands of companies after breaching ConnectWise, the IT management and remote access provider, according to security researchers at Microsoft.
Microsoft said the attackers broke into ConnectWise’s cloud backup service and stole application credentials used to link the service with corporate customers who depend on it to back up company data. With those credentials, the hackers could sign in to customers’ Microsoft-hosted environments as authorized users and access emails and other files.
The scale and speed of the attack were driven by AI. Microsoft reported that the hackers used AI agents to compromise around 2,250 organizations, making nearly 3,000 sign-in attempts per minute, a pace it said leaves defenders very little time to detect and respond. The agents ran on ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses.
The same framework was recently used in an attack on South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication.
ConnectWise said it has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working to restore the service.
