Chinese Hackers Exploit ConnectWise Breach Using AI to Infiltrate Thousands of Companies

Image: TechCrunch · Source

Chinese state-linked hackers breached IT firm ConnectWise, using stolen cloud credentials and AI-powered tools to access over 2,000 companies' Microsoft environments, rapidly stealing data and emails.

A recent cybersecurity incident involving IT management giant ConnectWise has led to widespread espionage against thousands of companies, security researchers at Microsoft report. The breach originated when China-aligned hackers infiltrated ConnectWise’s cloud backup service and stole application credentials. These credentials enable communication links between ConnectWise and its corporate customers, many of whom entrust this cloud service to safeguard their business data.

By obtaining these credentials, the attackers impersonated authorized users, gaining access to customers’ Microsoft-hosted environments. This allowed them to view sensitive emails and files across an estimated 2,250 organizations. Microsoft detailed that these intrusions occurred at a staggering pace, with nearly 3,000 login attempts per minute, overwhelming traditional defenses and limiting the window for detection and response.

The remarkable speed of these breaches has been attributed to the deployment of AI agents, specifically leveraging ARTEX — an open source AI framework designed to work with AI models to rigorously test cybersecurity measures. Microsoft notes that ARTEX and similar AI-driven tools enhance attackers’ capacity to automate and scale complex attacks, as was previously demonstrated in the compromise of South Korea’s financial systems where many networks lacked robust safeguards such as multi-factor authentication.

In response, ConnectWise has suspended access to its cloud backup platform and launched an investigation into the breach. Efforts to restore services are ongoing, as the company aims to contain and remediate the fallout from this significant cybersecurity event.

This incident underscores a growing trend where sophisticated cyber adversaries leverage artificial intelligence to accelerate attack velocity and scale, posing substantial challenges to the security community in protecting critical IT infrastructures and customer data.