What changed
Chinese hackers, aligned with the Chinese state, accessed data from thousands of companies after breaching ConnectWise, an IT management and remote access company. Microsoft security researchers reported that the hackers gained access to ConnectWise’s cloud backup service, stealing application credentials used to establish data links between ConnectWise and its corporate customers.
What this means in practice
The breach allowed the hackers to log in to the customer’s Microsoft-hosted environment as authorized users, enabling them to access emails and other files. Microsoft noted that the hackers used AI agents to rapidly hack into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. This speed gave defenders little time to detect and respond. The AI software used, ARTEX, is an open source framework that works with AI models to stress-test cyber defenses. The same AI software was previously used in a compromise of South Korea’s financial systems, where many lacked multi-factor authentication.
Limitations and availability
ConnectWise has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service. The supplied announcement does not specify the exact number of affected companies or the full extent of data accessed. The breach highlights vulnerabilities in cloud security and the potential for AI to accelerate cyberattacks.
