Microsoft researchers report that China state-aligned hackers breached ConnectWise’s cloud backup service, stole application credentials used to connect ConnectWise to its customers, and used those credentials to access the Microsoft-hosted environments of roughly 2,250 organizations.
What happened
Attackers gained access to ConnectWise’s cloud backup system and exfiltrated credentials that establish data links between ConnectWise and its corporate customers. With those credentials, the hackers were able to log into customers’ Microsoft-hosted environments as if they were authorized users, giving them access to emails and other files.
Speed and method
According to Microsoft, the attackers deployed AI agents to carry out the mass intrusions at high speed — nearly 3,000 attempted sign-ins per minute — enabling them to compromise about 2,250 organizations while allowing defenders little time to detect or respond.
Microsoft identified the AI tooling used as ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. The same ARTEX software was previously used in a compromise of South Korea’s financial systems, where many targets had weak security and lacked multi-factor authentication.
Corporate response
ConnectWise said it has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company stated it was working on restoring the service.
Why this matters
The incident illustrates two key risks: a breach of a third-party service can expose many otherwise unrelated organizations at once; and AI-accelerated attacks can dramatically increase the pace of intrusion attempts, shrinking defenders’ windows for detection and mitigation. Prior incidents emphasize that weak security practices — for example, absence of multi-factor authentication — increase vulnerability.
Next steps
An investigation and remediation efforts are underway. ConnectWise is examining the incident and working to restore service, while Microsoft has published technical findings intended to help organizations detect and defend against similar AI-driven mass intrusion attempts.
(Details in this article are based on statements and technical findings attributed to Microsoft and ConnectWise.)
