AI
AI-assisted hackers used ConnectWise breach to target about 2,250 organizations
Chinese state-aligned hackers breached ConnectWise’s cloud backup service and stole application credentials that linked the platform to customers’ Microsoft environments, Microsoft researchers said. The credentials could let attackers access customer emails and files as authorized users. Microsoft attributed roughly 2,250 attempted compromises, running at nearly 3,000 sign-ins per minute, to AI agents using the open-source ARTEX framework. ConnectWise paused access to its backup service and was still investigating and restoring operations; the report does not establish how many customer environments were successfully accessed.
Editorial summary · Publisher article
What matters
- The stolen credentials could let attackers log in as if they were authorized users in customer Microsoft environments.
- Microsoft said AI agents enabled rapid, automated attacks with little time for defenders to respond.
- The same AI framework was linked in the report to a recent compromise of South Korean financial systems.
Context & caveats
- Microsoft’s account describes attempted access and the attack method; the extent of successful customer compromise remained under investigation.
Why this made the edition
The report gives a specific breach mechanism, affected service, attributed technical findings and response status. The scale of access and the company’s investigation remain unresolved, which is clearly stated.
Source material