Microsoft says China state–aligned hackers surveilled thousands of businesses after breaching IT giant ConnectWise

Microsoft security researchers say China state–aligned hackers breached the cloud backup service of IT management and remote access giant ConnectWise, stealing application credentials used to connect ConnectWise with enterprise customers, then logging in as authorized users to customers' Microsoft hosted environments and accessing their email and other files. According to Microsoft's count, the hackers, using AI agents, broke into about 2,250 organizations at a rate of nearly 3,000 login attempts per minute, a speed Microsoft says leaves defenders almost no time to detect and respond. Microsoft attributes the accelerated attack to the open-source AI framework ARTEX, which works with AI models to stress-test cyber defenses; the same AI software was also used in a recent breach of South Korean financial systems, many of which had weak security and lacked multi-factor authentication. ConnectWise has suspended access to the cloud backup system and opened an investigation, and as of Thursday was still restoring service.