China state-aligned hackers broke into ConnectWise’s cloud backup service and stole credentials used to connect the service with customers’ systems, Microsoft security researchers say. Those credentials could let the attackers enter customers’ Microsoft-hosted environments as authorized users and reach email and other files.
Microsoft says the hackers used AI agents to make nearly 3,000 sign-in attempts per minute against around 2,250 organizations. That figure describes attempted sign-ins; the source does not say how many attempts succeeded or identify the organizations affected.
How the breach worked
The stolen application credentials link ConnectWise’s backup service to corporate customer accounts. Once inside a customer’s Microsoft environment, attackers could access data there, rather than only the backups held by ConnectWise.
Microsoft attributed the speed of the campaign to ARTEX, an open-source AI framework designed to work with AI models to stress-test cyber defenses. The source says the same software was used in a recent compromise of South Korea’s financial systems, where many organizations reportedly had weak security and lacked multi-factor authentication. It does not provide technical details about how ARTEX was used in either incident.
ConnectWise response
ConnectWise said it had paused access to its cloud backup system and was investigating the breach. On October 22, the company said it was working to restore the service. The source does not name affected customers, say how many accounts were successfully accessed, or specify what data the attackers obtained.
Microsoft’s account highlights how stolen credentials can turn a service-provider breach into a route toward customers’ own systems. But the reported pace of sign-in attempts does not, by itself, show that every targeted organization was breached.
Why it matters
For companies that connect Microsoft-hosted accounts to ConnectWise’s backup service, stolen credentials could expose email and other files beyond the backup system. The source does not identify affected customers or confirm how many organizations had data accessed, so the actual reach remains unclear.
