Microsoft: China hackers used AI agents to spy on 2,250 firms via ConnectWise

The ConnectWise breach stands out less for the intrusion itself than for how the attackers scaled it. According to Microsoft, the hackers did not need to break into each customer individually; they stole the application credentials that ConnectWise uses to link its cloud backup service to corporate customers, then logged in as authorized users. That turned a single breach at an IT management and remote access provider into access to emails and other files across thousands of organizations.

The use of AI agents is what made the campaign fast enough to overwhelm defenses. Microsoft says the hackers attempted almost 3,000 sign-ins per minute across around 2,250 organizations, a pace it says gives defenders little time to detect and respond. The framework named by Microsoft, ARTEX, is an open source AI tool designed to stress-test cyber defenses — the same software Microsoft says was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication.

ConnectWise has paused access to its cloud backup system and, as of Thursday, said it was working on restoring the service. For the customers involved, the immediate question is not only whether the hackers got in, but whether the credentials that made the links work have been fully invalidated — a process that, by Microsoft's account, the attackers were able to outrun.