Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise

What happened

Hackers linked to the Chinese state broke into ConnectWise's cloud backup service. They stole login keys, called application credentials, that link ConnectWise to its business customers. With these keys, the hackers could sign in to customers' Microsoft-hosted systems as if they were trusted users. From there, they could read emails and other files.

Key numbers

• About 2,250 organizations were targeted.
• The hackers tried almost 3,000 sign-ins per minute.
• Microsoft says this speed leaves defenders "little time to detect and respond."
• ConnectWise has paused access to its cloud backup system while it investigates.

How AI was used

Microsoft says the hackers used AI agents, which are programs that can carry out tasks on their own. The tool named in the article is ARTEX, an open source AI framework. Open source means its code is free for anyone to view and use. The same AI software was used in a recent attack on South Korea's financial systems, where many systems had weak security and did not require multi-factor authentication, an extra step like a code sent to your phone.

Why it matters

This attack shows how one company's weak point can open doors to many other companies. It also shows that AI can help attackers move much faster than before. Defenders may have very little time to spot and stop an attack.

What to watch

• When ConnectWise restores its cloud backup service.
• What further details Microsoft and ConnectWise share about the breach.
• How many customers were affected in the end.