Microsoft Links ConnectWise Breach to Spying on 2,250 Organizations

Microsoft says China-aligned hackers used stolen credentials from ConnectWise’s cloud backup service to access customer environments and spy on organizations.

According to Microsoft security researchers, the attackers breached the service and stole application credentials used to connect ConnectWise with corporate customers. Those credentials let the hackers access customers’ Microsoft-hosted environments as authorized users, including their emails and other files.

Microsoft says the hackers targeted around 2,250 organizations, making almost 3,000 attempted sign-ins per minute. It attributed the speed to AI agents, which it said gave defenders “little time to detect and respond.” Microsoft identified the software as ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses.

The source report says the same AI software was used in a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication.

ConnectWise said it had paused access to its cloud backup system and was investigating the breach. As of Thursday, the company said it was working to restore the service.