Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise

Microsoft says China state-aligned hackers breached ConnectWise’s cloud backup service and stole application credentials used to link ConnectWise with corporate customers’ systems. The stolen credentials allowed the attackers to sign in to customers’ Microsoft-hosted environments as authorized users, potentially accessing email and other files. Microsoft said the attackers used AI agents to target about 2,250 organizations, attempting nearly 3,000 sign-ins per minute. Microsoft said the pace left defenders little time to detect and respond. The activity was attributed to ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. ARTEX was also used in a recent compromise of South Korean financial systems, according to the report, where many affected organizations had weak security and lacked multifactor authentication. ConnectWise paused access to its cloud backup system while it investigates the breach. As of Thursday, the company said it was working to restore the service.