Microsoft says China-aligned hackers used AI agents to breach about 2,250 ConnectWise customers

Chinese state-aligned hackers have spied on thousands more companies after breaching ConnectWise, the IT management and remote access provider, according to security researchers at Microsoft. TechCrunch reported the findings, which describe a breach of ConnectWise's cloud backup service and the theft of credentials tied to it.

Microsoft says the stolen application credentials are used to establish data links between ConnectWise and corporate customers who rely on the service to back up company data. With them, the hackers could log in to a customer's Microsoft-hosted environment as if they were an authorized user, and access emails and other files.

Microsoft says the attackers used AI agents to break into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. The company said this speed gives defenders 'little time to detect and respond.' The speed was attributed to ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses.

ConnectWise said it has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.

The incident combines two concerns: supply-chain risk and AI-assisted speed. ConnectWise sits between service providers and their customers, so a single compromise of stored credentials gave attackers a route into thousands of separate environments without needing to breach each one directly.

The reported use of ARTEX is notable because it is an open source framework intended for stress-testing defenses. According to the coverage, the same software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication. That suggests the tooling is being reused across campaigns, though the coverage does not give further detail on how the attacks were run.

The rate Microsoft cites, almost 3,000 attempted sign-ins per minute, would be hard for manual review to follow. If accurate, it argues for faster automated detection and for controls such as multi-factor authentication, though the coverage does not say whether those would have stopped this particular attack.

The main open items are ConnectWise's investigation and the restoration of its cloud backup service. The coverage does not give a timeline, nor does it say how many of the roughly 2,250 targeted organizations had data accessed.

It is also unclear whether ConnectWise or Microsoft will publish further technical detail, such as how the credentials were stolen, or whether other agencies or vendors will confirm the attribution to a China-aligned group.