ConnectWise cloud backup breach enabled access to 2,250 organizations
Stolen ConnectWise credentials opened customer environments
China state-aligned hackers breached ConnectWise’s cloud backup service and then used stolen application credentials to target about 2,250 organizations, Microsoft said. The credentials established data links between ConnectWise and corporate customers that use the service to back up company data.
By obtaining those credentials, the intruders could sign in to a customer’s Microsoft-hosted environment as though they were authorised users. Microsoft said the resulting access could expose email and other files.
The activity illustrates the consequence of a compromise at a technology provider whose services connect to many customer environments. In this case, the stolen credentials were not merely internal ConnectWise access details; they could be used to reach the organisations linked to the cloud backup service.
Microsoft attributes the pace to AI agents
Microsoft said the attackers used AI agents to compromise organisations at a rate of nearly 3,000 attempted sign-ins per minute. At that pace, defenders have little time to identify and respond to suspicious authentication activity.
The researchers attributed the speed of the campaign to ARTEX, an open-source AI framework designed to work with AI models for stress-testing cyber defences. The same software was used in a recent compromise affecting South Korea’s financial systems, where many systems had weak security and no multi-factor authentication.
Microsoft characterised the group as China state-aligned. Its account connects the scale of the incident to the ability to automate login attempts after gaining valid credentials, rather than to a conventional attempt to breach each customer separately.
Service access paused during the investigation
ConnectWise said it had paused access to its cloud backup system while it investigates the breach. As of Thursday, the company said it was working to restore the service.
For organisations using managed cloud services, the incident makes third-party application credentials an immediate review point. Teams should identify connections between providers and Microsoft-hosted environments, rotate or revoke credentials where required, and verify that multi-factor authentication covers relevant administrative access paths.
The practical business implication is that backup and management integrations must be treated as privileged access relationships: an incident response plan should include rapid containment of provider-linked credentials alongside recovery of the affected service.