The cybersecurity landscape worsened for thousands of firms after Chinese hackers, linked to the Chinese state, infiltrated IT management and remote access provider ConnectWise.
Microsoft security researchers reported that the attackers compromised ConnectWise's cloud backup service and extracted application credentials that enable data connections between ConnectWise and its corporate clients, who depend on the service for backing up company data.
With those credentials, the intruders could sign into the customers' Microsoft-hosted environments as legitimate users, gaining access to emails and other files.
Microsoft said the hackers employed AI agents to swiftly target roughly 2,250 organisations, generating nearly 3,000 sign-in attempts per minute, a pace that leaves defenders "little time to detect and respond."
The rapid attacks were linked to AI agents, notably the open-source framework ARTEX, which works with AI models to stress-test cyber defenses. The same tool was previously used in a compromise of South Korea's financial systems, many of which lacked multi-factor authentication.
ConnectWise announced it has halted access to its cloud backup system and is investigating the incident. As of Thursday, the firm said it was working to restore the service.
