Chinese Hackers Breach ConnectWise, Deploy AI Agents to Infiltrate 2,250 Companies

Chinese state-aligned hackers breached IT management provider ConnectWise's cloud backup service to access the environments of corporate customers. Microsoft security researchers reported the attackers stole application credentials to bypass Microsoft-hosted customer environments, accessing emails and corporate files. According to Microsoft, the attackers deployed AI agents to hit over 2,250 tenants via ARTEX at a rate of nearly 3,000 sign-in attempts per minute. The automated intrusions were powered by ARTEX, an open-source AI framework originally designed to stress-test cyber defenses, which Microsoft noted gives defenders little time to detect the activity. The ARTEX software was previously utilized in a recent compromise of South Korean financial systems that lacked multi-factor authentication. ConnectWise has paused access to its cloud backup infrastructure and stated Thursday it is investigating the breach while working on a restoration timeline. "This speed gives defenders little time to detect and respond." — Microsoft.