Chinese hackers use AI to breach ConnectWise and target 2,250 firms

Chinese state-aligned hackers broke into ConnectWise’s cloud backup service, allowing them to spy on thousands of companies, Microsoft said. The attackers stole application credentials used to connect ConnectWise with its corporate clients, enabling access to emails and files as if they were authorised users.

Microsoft’s security team reported that the hackers used AI agents, including the open source ARTEX framework, to automate attacks and attempt almost 3,000 sign-ins per minute. This allowed them to compromise around 2,250 organisations before defenders could respond. The same AI tool was previously linked to breaches in South Korea’s financial sector, where weak security and lack of multi-factor authentication made systems vulnerable.

ConnectWise has paused access to its cloud backup system and is investigating the breach. The company is working to restore service. The incident raises concerns for firms relying on third-party IT providers for data protection and highlights the need for strong authentication and rapid incident response.