Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
Key points
- Microsoft says China state-aligned hackers breached ConnectWise's cloud backup service and stole customer credentials.
- The hackers used AI agents to attempt about 2,250 organization sign-ins at nearly 3,000 per minute.
- ConnectWise has paused access to its cloud backup system and is investigating the breach.
Microsoft security researchers say hackers aligned with the Chinese state broke into ConnectWise's cloud backup service and stole application credentials used to link the IT management and remote access company with its corporate customers. With those credentials, the hackers could sign in to customers' Microsoft-hosted environments as authorized users and reach their emails and other files, according to Microsoft.
The hackers targeted roughly 2,250 organizations, according to Microsoft. ConnectWise said it has paused access to its cloud backup system and is investigating the breach, and as of Thursday it was working to restore the service.
AI agents drove the speed
Microsoft attributed the pace of the mass intrusion to AI agents, which it said made almost 3,000 attempted sign-ins per minute. The company said this speed leaves defenders "little time to detect and respond."
Microsoft specifically named ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. The same AI software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication.
little time to detect and respond
— Microsoft
