Microsoft: Chinese-Linked Hackers Spied on Thousands of Firms After ConnectWise Breach

Microsoft researchers say a hacking group it links to the Chinese state broke into ConnectWise's cloud backup service and stole application credentials used to connect the IT management giant with its corporate customers. With those credentials, the intruders could sign in to customers' Microsoft-hosted environments as authorized users and reach emails and other files.

According to Microsoft, the attackers used AI agents to attempt break-ins at roughly 2,250 organizations, trying almost 3,000 sign-ins per minute - a pace the company said leaves defenders little time to detect and respond. Microsoft tied the speed to an open-source AI framework called ARTEX, which it says works with AI models to stress-test cyber defenses; the same software, Microsoft said, featured in a recent compromise of South Korea's financial systems, where many networks had weak security and no multi-factor authentication.

ConnectWise said it has paused access to its cloud backup system and is investigating the breach, and that it was working on restoring the service as of Thursday. The company did not offer further detail in its statement.

Source: TechCrunch