A breach of ConnectWise’s cloud backup service gave China state-aligned hackers a way into the Microsoft-hosted environments of its corporate customers, according to Microsoft security researchers. The stolen application credentials let the intruders appear to be authorized users, exposing emails and other files.
How stolen credentials reached customer data
ConnectWise provides IT management and remote access services, including a cloud backup system that companies use to preserve their data. The service relies on application credentials to establish data links between ConnectWise and its corporate customers.
Microsoft says hackers broke into the backup service and stole those credentials. With them, the attackers could log in to a customer's Microsoft-hosted environment as though they had legitimate access. That access could expose company emails and other files.
The incident shows why credentials that connect a service to its customers can be consequential. When those credentials are taken, attackers may be able to use the existing connection to reach customer environments, rather than needing to obtain access separately from each company.
AI agents accelerated the attempted intrusions
Microsoft says the hackers used AI agents to target around 2,250 organizations, making almost 3,000 attempted sign-ins per minute. At that pace, defenders have little time to identify suspicious activity and respond, Microsoft said.
The software cited was ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. In this incident, it was used to move through attempted sign-ins at a speed that could make monitoring and response more difficult.
Fast, automated attempts put pressure on organizations to notice activity quickly. The reported rate describes attempted sign-ins, while the source does not say that every attempt succeeded or that every targeted organization was compromised.
ConnectWise paused the backup service
ConnectWise said it had paused access to its cloud backup system and was investigating the breach. As of Thursday, the company said it was working to restore the service.
Pausing access can limit use of a service while an investigation is underway, but it also means customers relying on that system must wait for restoration. The source does not provide a timeline for recovery or further details about the investigation.
For customers, the incident links a breach at a service provider with access to data held in their own Microsoft environments. The reported route into those systems ran through application credentials used to connect the backup service with customer accounts.
A reported connection to another cyber incident
The article says the same AI software was used in a recent compromise of South Korea’s financial systems. It adds that many of those systems had weak security and lacked multi-factor authentication.
That reference places ARTEX in more than one reported cyber incident, but the available details do not establish that the events were connected. In the ConnectWise case, Microsoft attributed the rapid mass-hacking activity to AI agents using the framework.
The immediate questions for ConnectWise are how the breach occurred, what customer data was accessed, and when the backup service can return. The source reports that the company is investigating and working on restoration, while Microsoft describes the scale and pace of the attempted sign-ins.