Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise

The material received is a short item ("In Brief" section) from TechCrunch, not an extended analysis, so this summary is short and limited to what the text reports.

According to the article, Chinese state-aligned hackers managed to break into the cloud backup service of ConnectWise, an IT management and remote access company. Microsoft security researchers say the attackers stole application credentials. These credentials are used to establish the data links between ConnectWise and its corporate customers, who rely on that service to back up their data.

With those credentials, the attackers could sign in to each customer's Microsoft-hosted environment as if they were authorized users, and thereby access emails and other files.

Microsoft says the attackers used AI agents to rapidly breach some 2,250 organizations, at a rate of nearly 3,000 login attempts per minute. According to Microsoft, that speed leaves defenders "little time to detect and respond."

The article attributes that speed to the use of ARTEX, an open-source AI framework that works with AI models to test computer defenses. According to the text, the same software was used in a recent attack on South Korea's financial systems, many of which had weak security and lacked multifactor authentication.

ConnectWise has paused access to its cloud backup system and is investigating the breach. According to the article, on Thursday the company was working to restore the service.

The text offers no further details, such as the identity of the attacking group, the date of the initial access or the type of data stolen.