Chinese State-Linked Hackers Exploit ConnectWise Breach to Target Thousands of Companies

Credential Theft Enables AI-Powered Assault on Corporate Networks

Security researchers at Microsoft have identified a group of Chinese state-aligned hackers who penetrated the cloud backup service of IT management giant ConnectWise. By stealing application credentials that connect ConnectWise’s platform to its corporate customers, the attackers gained the ability to impersonate authorized users and access emails and other files stored in Microsoft-hosted environments.

The breach, disclosed as part of a broader cybersecurity crisis this week, affected thousands of additional organizations. According to Microsoft, the intruders deployed AI agents to automate the intrusion, compromising roughly 2,250 organizations at a staggering pace of nearly 3,000 attempted sign‑ins per minute. The rapid tempo left defenders with “little time to detect and respond,” the company warned.

Investigators traced the attack’s speed to ARTEX, an open‑source AI framework designed to stress‑test cyber defenses. The same software was previously implicated in a compromise of South Korea’s financial sector, where many institutions suffered from weak security controls and the absence of multi‑factor authentication.

ConnectWise has halted access to its cloud backup system while it conducts a thorough investigation. As of Thursday, the firm reported that restoration efforts were underway, though the full scope of the incident remains under review.

Implications for AI‑Driven Threats

The incident illustrates how AI tools, originally intended for defensive testing, can be repurposed by adversaries to accelerate large‑scale credential abuse. The use of ARTEX highlights a growing trend where publicly available AI frameworks lower the barrier for sophisticated attacks, amplifying the risk for organizations that rely on third‑party cloud services.

For enterprises dependent on ConnectWise’s backup solution, the breach underscores the importance of robust credential management and the need for layered security measures, including multi‑factor authentication, even when accessing services through trusted providers.

As the cybersecurity community grapples with the fallout, the episode serves as a stark reminder that state‑linked actors are increasingly leveraging advanced automation to infiltrate critical infrastructure, and that rapid response capabilities are essential to mitigate damage.