ConnectWise Breach Discovered
Thousands of companies were targeted by Chinese hackers after a breach of IT management and remote access provider ConnectWise.
Microsoft security researchers reported that state-aligned hackers from China infiltrated ConnectWise's cloud backup service. They stole application credentials used to link ConnectWise with its corporate customers, who depend on the service for data backups.
These stolen credentials allowed the attackers to log into customer Microsoft-hosted environments, gaining unauthorized access to emails and other sensitive files.
AI Agents Accelerate Attacks
Microsoft revealed that the hackers deployed AI agents to rapidly compromise approximately 2,250 organizations, attempting nearly 3,000 sign-ins per minute. This unprecedented speed significantly reduced the time available for defenders to detect and respond to the attacks.
The rapid pace of these mass compromises was linked to the use of AI agents, specifically ARTEX. ARTEX is an open-source AI framework designed to work with AI models for stress-testing cyber defenses. This same AI software was previously implicated in a compromise of South Korea’s financial systems, which often exhibited weak security and lacked multi-factor authentication.
ConnectWise Response
ConnectWise has temporarily suspended access to its cloud backup system and is actively investigating the breach. The company stated it is working towards restoring the affected service.
