Chinese hackers spied on thousands of companies after breaching ConnectWise
China state-aligned hackers broke into the cloud backup service of IT management firm ConnectWise and stole application credentials. Microsoft researchers say AI agents helped them compromise about 2,250 organizations.
Hackers aligned with the Chinese state have breached the cloud backup service of ConnectWise, a provider of IT management and remote access software, and then spied on thousands of its customers' organizations. Microsoft security researchers reported the findings on Thursday, October 22. The incident matters because it hit companies that had entrusted the backup of their data to a third-party service.
How the attack worked
According to Microsoft, the hackers stole application credentials that ConnectWise uses to establish data links with its corporate customers. With those credentials, the attackers could sign in to a customer's Microsoft-hosted environment as if they were an authorized user and access emails and other files.
The hackers used AI agents to break into around 2,250 organizations quickly, at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said this speed gives defenders "little time to detect and respond."
The tool used
The speed of the mass intrusions was attributed to ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. The same software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication.
ConnectWise response
ConnectWise said it has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.
