Microsoft: China-Aligned Hackers Breached ConnectWise and Spied on 2,250 Organizations

Microsoft said the hackers used AI agents to carry out the mass intrusion at a rate of almost 3,000 attempted sign-ins per minute, a speed that gave defenders little time to detect and respond. The company attributed the pace to ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. Microsoft said the same AI software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication.

ConnectWise said it had paused access to its cloud backup system and was investigating the breach. As of Thursday, the company said it was working to restore the service.

The affected customers relied on ConnectWise's cloud service to back up company data. Microsoft said the stolen application credentials are used to establish data links between ConnectWise and its corporate customers, which is how the hackers were able to reach customer environments hosted by Microsoft.

ConnectWise is an IT management and remote access company whose cloud backup service is used by corporate customers. Microsoft's account describes an intrusion that moved from a trusted service provider into customer systems, with the hackers using stolen credentials rather than breaking into each organization's network directly.