Thousands of companies that rely on ConnectWise's cloud backup service were spied on by Chinese hackers after the IT management and remote access giant was breached, according to security researchers at Microsoft.
The China state-aligned hackers broke into ConnectWise's cloud backup service and stole application credentials used to establish data links between ConnectWise and its corporate customers, who depend on the cloud service to back up company data. With those credentials, the hackers could log in to a customer's Microsoft-hosted environment posing as an authorized user and reach emails and other files.
Microsoft said the hackers used AI agents to rapidly compromise around 2,250 organizations, attempting almost 3,000 sign-ins per minute. That pace, according to Microsoft, leaves defenders little time to detect and respond to the intrusions.
The speed of the mass hacks was attributed to the use of AI agents, specifically ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses. The same AI software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication.
ConnectWise said it has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.
The incident extends a bad week for cybersecurity, with the ConnectWise breach widening the exposure to thousands more companies beyond the IT giant itself. For US businesses that use ConnectWise's cloud backup service, the stolen credentials could have allowed unauthorized access to data held in their Microsoft-hosted environments.
More cybersecurity news from TechManNews.
