Microsoft says China-linked hackers breached ConnectWise and spied on customers

In short: Microsoft says China-aligned hackers broke into ConnectWise’s cloud backup service and then used stolen login details to access thousands of customer systems.

What happened

Microsoft security researchers said the attackers breached ConnectWise, a company many businesses use to manage IT and remotely access systems. The hackers got into ConnectWise’s cloud backup service, which stores copies of company data online.

Microsoft said the hackers stole application credentials, which are like special “keys” that let ConnectWise connect to a customer’s systems. With those keys, the attackers could log in to a customer’s Microsoft-hosted setup as if they were an approved user, and then access emails and files.

Microsoft said the attackers used AI agents, meaning automated tools that can carry out tasks quickly with little human input (like a robot assistant running a checklist). Microsoft said this helped the hackers target around 2,250 organizations, with nearly 3,000 attempted sign-ins per minute, leaving defenders little time to react.

Microsoft tied the speed of the attempts to a tool called ARTEX, described as an open-source framework used to test defenses. The report also notes that similar tooling has been linked to other incidents, including attacks on parts of South Korea’s financial sector.

ConnectWise said it paused access to its cloud backup system while it investigates. The company said it was working to restore the service.

Why it matters

Even if your own company was not using ConnectWise, this shows how one break-in at a widely used service provider can quickly spread to many organizations, like copying one master key and trying it on thousands of doors. It also highlights how automated AI-based tools can make attacks faster, which can increase the risk of data exposure and account takeovers.

Source: TechCrunch AI