Chinese hackers exploit ConnectWise breach to infiltrate thousands

State-aligned Chinese actors leveraged a security compromise at IT giant ConnectWise to infiltrate thousands of corporate environments. By harvesting cloud backup credentials, the attackers bypassed traditional defenses, gaining unauthorized access to sensitive emails and internal files across a vast network of unsuspecting businesses, according to Microsoft security researchers.

Today, 20:13· Business Faces· 1,443 reads

The attackers targeted the company’s cloud backup service, stealing credentials meant to secure data links between ConnectWise and its clients. These credentials effectively granted the hackers the identity of authorized users, allowing them to navigate Microsoft-hosted environments with ease. Microsoft reported that the operation relied on AI agents—specifically the open-source ARTEX framework—to execute the campaign at a staggering velocity. The attackers initiated nearly 3,000 sign-in attempts per minute, successfully compromising approximately 2,250 organizations in a window that left defenders almost no time to react.

This same ARTEX framework was previously linked to intrusions within South Korean financial systems, where inadequate multi-factor authentication protocols left networks vulnerable. ConnectWise has since suspended access to its cloud backup infrastructure to contain the fallout. The firm is currently conducting an investigation into the breach while working to restore services for its affected clients.

Chinese hackers exploit ConnectWise breach to infiltrate thousands

Comments (0)