Chinese hackers used stolen ConnectWise backup credentials to reach customers
Original title: Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
Microsoft says AI agents drove nearly 3,000 sign-in attempts a minute against about 2,250 organizations.
Microsoft says China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials used to link the service to corporate customers. With those credentials the attackers could sign in to customers’ Microsoft-hosted environments and reach emails and other files. Microsoft attributes the pace, almost 3,000 attempted sign-ins a minute across around 2,250 organizations, to AI agents using the open-source ARTEX framework. ConnectWise has paused the backup service and said Thursday it was investigating and working to restore it.
Unconfirmed: Microsoft attributes the intrusion to China state-aligned hackers but does not name a group in this report.
- About 2,250 organizations were targeted, according to Microsoft.
- The same ARTEX software was used in a recent compromise of South Korean financial systems.
- Microsoft said the speed leaves defenders little time to detect and respond.
- ConnectWise paused cloud backup access while it investigates.
Impact: Access to customer emails and files via stolen app credentials
| Product | Affected |
|---|---|
| ConnectWise cloud backup service | — |
- Vendors
- ConnectWise
- Products
- ConnectWise cloud backup
- Malware
- ARTEX
- Victims
- ConnectWise
- Organizations
- Microsoft
- Countries
- ChinaSouth Korea
From the original article
1 min read at techcrunch.com
Microsoft points the blame for ConnectWise's breach at a China-aligned hacker, which relied on AI agents to rapidly hack into thousands of its customers.
By Zack Whittaker · techcrunch.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.