Thousands of companies have been spied on by Chinese hackers after they breached the cloud backup service of IT management firm ConnectWise. Security researchers at Microsoft state that state-aligned actors stole application credentials used to link ConnectWise with its corporate customers. By taking these keys, the attackers could log into the Microsoft-hosted environments of infected firms as authorised users. This access allowed them to read emails and download other files without raising immediate alarms. Microsoft reports the hackers used AI agents to infiltrate approximately 2,250 organisations at a rate of nearly 3,000 attempted sign-ins per minute. This velocity leaves defenders little time to detect and respond to the intrusion. The speed of the mass hacks is attributed to ARTEX, an open-source AI framework designed to stress-test cyber defences. ConnectWise has paused access to its cloud backup system while it investigates the breach and works on restoring the service.
The incident matters because it exposes how automation can accelerate attacks beyond human reaction limits. The same software was recently used to compromise South Korea’s financial systems, suggesting a repeatable pattern of exploitation. Weak security measures and a lack of multi-factor authentication left many targets vulnerable. This breach demonstrates that standard defences may struggle against automated, high-volume credential theft.
- Approximately 2,250 organisations were targeted.
- Attackers attempted nearly 3,000 sign-ins per minute.
- ConnectWise has paused access to its cloud backup service.
