ConnectWise Attack: Microsoft Attributes Access to Data of Thousands of Customers to China-Aligned Hackers

According to Microsoft, credentials stolen from the cloud backup service allowed access to customers' Microsoft environments; the use of AI agents is said to have accelerated access to about 2,250 organizations. ConnectWise has suspended the service and is working to restore it.

Microsoft's account

Microsoft security researchers attribute the breach of ConnectWise, a company that provides IT management and remote access services, to a China state-aligned hacking group. According to the account, the attackers entered ConnectWise's cloud backup service and stole the application credentials used to connect data between ConnectWise and its business customers, who rely on that service to save backups of their information.

With those credentials, the hackers could access customers' Microsoft environments as authorized users, and therefore read emails and other files. This is the central point of the accusation: not a direct attack on each individual company, but the use of a common supplier as an intermediary to reach its customers.

The Speed of Access and the Role of AI Agents

Microsoft claims that the hackers used AI agents to rapidly target about 2,250 organizations, with nearly 3,000 access attempts per minute. A pace that, according to the company, leaves defenders little time to detect and react.

The framework cited is ARTEX, an open-source tool that pairs artificial intelligence models in testing the strength of cyber defenses. The same software is said to have been used in a recent compromise of South Korea's financial systems, many of which had weak protections and did not include multi-factor authentication. The link between the two incidents is attributed to the source and does not constitute independent confirmation.

ConnectWise's reaction and the points to be verified

ConnectWise said it had suspended access to its cloud backup system and launched an investigation into the breach. On Thursday, the company announced that it was working to restore the service.

Several aspects remain to be clarified: the actual extent of the data accessed, the duration of the exposure window, the final number of organizations involved, and the measures taken for affected customers. The available information comes largely from Microsoft and ConnectWise itself, while there are no independent confirmations or details on the notifications sent to the affected companies.

Source and attribution: this original summary was prepared by AICronaca based on the report by TechCrunch — AI ↗. Statements are attributed to the source; any informational limitations: The material is based on statements from Microsoft and ConnectWise; no independent confirmations, lists of affected customers, or details on notifications are reported. The link to the compromise of South Korean financial systems is attributed to the source..