Microsoft says Chinese hackers used AI to breach ConnectWise

Microsoft security researchers report that China state-aligned hackers compromised ConnectWise’s cloud backup service, stealing application credentials that allowed them to access the Microsoft-hosted environments of approximately 2,250 corporate customers. According to TechCrunch, the attackers used these stolen credentials to log in as authorized users, granting them access to customer emails and other sensitive files. The breach highlights a critical vulnerability in third-party IT management platforms where compromised vendor credentials can cascade into widespread customer data exposure.

The mechanics of the mass intrusion

The speed of the attack was the defining characteristic of the breach. Microsoft stated that the hackers utilized AI agents to rapidly compromise organizations at a rate of almost 3,000 attempted sign-ins per minute. This velocity gave defenders "little time to detect and respond," according to the security firm. The specific tooling identified in the incident was ARTEX, an open-source AI framework designed to work with AI models to stress-test cyber defenses. The same software was reportedly used in a recent compromise of South Korea’s financial systems, where many targets lacked multi-factor authentication and had weak security postures.

By stealing the application credentials used to establish data links between ConnectWise and its customers, the attackers bypassed traditional perimeter defenses. They did not need to break into each customer’s individual firewall; they simply used the trusted connection already established by the IT management vendor. This allowed them to move laterally across thousands of distinct corporate environments with minimal friction.

ConnectWise response and service status

ConnectWise confirmed the incident, stating that it has paused access to its cloud backup system while it investigates the breach. As of Thursday, the company reported it was working on restoring the service. The pause in service is a significant operational disruption for the thousands of small and mid-sized businesses that rely on ConnectWise for IT management and remote access. For these organizations, the pause means not only a loss of backup capabilities but also a period of heightened uncertainty regarding the integrity of their data during the investigation.

Context: AI-driven threat acceleration

This incident fits into a broader trend of adversaries leveraging artificial intelligence to scale cyber operations. The use of ARTEX in both the ConnectWise breach and the South Korean financial sector compromise suggests a standardized toolkit for state-aligned actors. The reliance on open-source frameworks for high-velocity attacks lowers the barrier to entry for sophisticated intrusions, making it easier for less experienced operators to execute complex campaigns. The 3,000 sign-ins per minute metric is a concrete indicator of how AI agents can outpace human-led security operations centers, which typically rely on manual triage and slower response cycles.

What it means for developers and IT teams

For developers and IT professionals, this breach underscores the critical importance of credential hygiene and the risks associated with third-party integrations. Organizations should immediately audit their use of application credentials, particularly those shared with IT management vendors. The incident demonstrates that even if an organization has strong internal security, a breach in a trusted vendor’s infrastructure can expose sensitive data. Teams should verify that multi-factor authentication is enforced for all administrative access, including access to cloud backup services. Additionally, monitoring for unusual sign-in patterns, especially those originating from known IP ranges associated with the attacker, is essential. The speed of the attack means that real-time detection and automated response mechanisms are no longer optional but necessary for survival in the current threat landscape.

What to watch

• Restoration timeline: When ConnectWise fully restores its cloud backup service and whether any data was exfiltrated during the pause.
• ARTEX adoption: Whether other open-source AI frameworks are being used in similar high-velocity attacks against other IT management platforms.
• Regulatory response: How regulators in the US and South Korea respond to the use of AI agents in state-sponsored cyber operations, particularly regarding the export of such tools.
• Customer impact: The extent of data exposure among the 2,250 affected organizations and whether any specific sectors, such as finance or healthcare, were targeted with higher intensity.