Microsoft security researchers say China state-aligned hackers broke into the cloud backup service of IT management company ConnectWise, stole application credentials, and then used AI agents to gain access to around 2,250 customer organizations, where they read emails and other files. ConnectWise has paused the affected service and is investigating.
Microsoft security researchers have detailed a hacking campaign in which China state-aligned attackers breached the cloud backup service of ConnectWise, an IT management and remote access company, and used stolen credentials to spy on thousands of its corporate customers.
The researchers said the hackers stole application credentials used to establish data links between ConnectWise and its customers. With those credentials, the attackers could sign in to the customers' Microsoft-hosted environments as authorized users and access their emails and other files.
According to Microsoft, the hackers used AI agents to rapidly break into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. The speed, Microsoft said, gives defenders "little time to detect and respond."
The speed was attributed to AI agents, specifically ARTEX, an open-source framework that works with AI models to stress-test cyber defenses. Microsoft noted the same software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication.
ConnectWise said it has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service. The account of the intrusion comes from Microsoft's research; ConnectWise has said its own investigation is continuing.
Analysis
Why This Matters
- A single breach at an IT vendor has rippled out to roughly 2,250 customer organizations, illustrating the reach of supply-chain attacks.
- The use of AI agents to automate intrusions at nearly 3,000 sign-in attempts per minute compresses the window defenders have to detect and respond.
- Stolen backup credentials grant access to emails and other files, so affected organizations may face prolonged exposure before the compromise was found.
Background
IT management and remote access providers are frequent targets for state-aligned hacking groups because one compromise can open the networks of thousands of customers. This incident also reflects a growing pattern of attackers using AI tools to automate and accelerate intrusion attempts. The same open-source framework cited by Microsoft, ARTEX, was reportedly used in a recent attack on South Korea's financial systems, many of which lacked multi-factor authentication.
Key Perspectives
Microsoft: The security researchers say China state-aligned hackers breached ConnectWise's cloud backup service, stole application credentials, and used AI agents to break into about 2,250 organizations and access their data.
ConnectWise: The company says it has paused access to the affected cloud backup system, is investigating the breach, and was working to restore the service as of Thursday.
Critics and skeptics: Attribution of hacking campaigns to state actors is difficult to verify independently, and the extent of data accessed at each organization has not been disclosed. Affected customers face uncertainty about what was taken until the investigation concludes.
What to Watch
- Whether ConnectWise restores its backup service and what it discloses about which customers were affected.
- Any further reporting on what data the attackers viewed or took.
- Whether other organizations report intrusions traced to the same stolen credentials or the same AI tool.
