Chinese hackers aligned with the state exploited a cloud backup breach at IT giant ConnectWise to infiltrate thousands of organizations' systems, using AI agents to rapidly compromise corporate environments and steal sensitive data.
- Hackers stole credentials from ConnectWise’s cloud backup service to infiltrate customers
- AI agents enabled nearly 3,000 login attempts per minute on approximately 2,250 organizations
- ConnectWise paused affected services while investigating the security breach
What happened
Cybersecurity researchers at Microsoft uncovered a significant breach of IT management provider ConnectWise’s cloud backup service. Hackers linked to the Chinese state exploited stolen application credentials to gain unauthorized access to data linkages between ConnectWise and thousands of its corporate customers. This allowed them to impersonate authorized users and enter customers’ Microsoft-hosted digital environments, accessing confidential emails and files.
The attack was powered by AI-driven automation through the ARTEX framework, enabling the hackers to execute a rapid succession of sign-ins—up to 3,000 attempts per minute—targeting around 2,250 organizations. This volume and speed overwhelmed typical cybersecurity defenses, leaving victims with little time to detect or respond effectively.
Why it matters
This incident highlights escalating risks in supply chain cybersecurity, especially for IT service providers whose platforms interface with thousands of enterprise customers. By breaching ConnectWise’s cloud backup system, attackers gained a force multiplier effect, compromising a large number of organizations through a single entry point.
The use of advanced AI agents like ARTEX in cyberattacks represents a new frontier in offensive cybersecurity capabilities. These AI tools rapidly stress-test and exploit vulnerabilities at scale, demanding that defenders adopt equally sophisticated automated detection and response strategies. The breach exposes critical vulnerabilities such as inadequate multi-factor authentication across target environments.
What to watch next
ConnectWise’s ongoing investigation into the breach and their restoration of affected services will be closely monitored by the cybersecurity community and impacted organizations. How the company strengthens its credential protections and cloud backup defenses will be key in preventing similar attacks.
Further developments in AI-powered cyber intrusions are expected, pushing enterprises and security vendors to accelerate AI-driven defense innovation. Observers should also watch for regulatory responses and potential wider geopolitical ramifications due to the involvement of state-aligned hackers.