A bad week for cybersecurity got even worse for thousands of companies spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise.
Microsoft security researchers say Chinese state-backed hackers infiltrated ConnectWise’s cloud backup service and stole application credentials used to establish data links between ConnectWise and enterprise customers who use the cloud service to back up corporate data.
By stealing credentials, a hacker could log into a customer’s Microsoft-hosted environment and access email and other files as if they were an authorized user.
Microsoft said the hackers used an AI agent to rapidly hack into about 2,250 organizations at a rate of nearly 3,000 sign-in attempts per minute. Microsoft said this speed gives defenders “little time to detect and respond.”
The speed of the massive hack was due to the use of ARTEX, an open source AI framework that works with AI agents, specifically AI models, to stress test cyber defenses. The same AI software was used in the recent breach of South Korea’s financial system, but much of it had weak security and lacked multi-factor authentication.
ConnectWise said it has suspended access to its cloud backup system and is investigating the breach. The company said as of Thursday it was working to restore service.
