ConnectWise cloud breach allowed Chinese hackers using autonomous AI agents to infiltrate 2,250 corporate networks
Stolen cloud backup credentials enabled automated credential stuffing at 3,000 requests per minute using the open-source ARTEX AI framework.
Technology news
Cybersecurity researchers at Microsoft disclosed Thursday that state-sponsored Chinese threat actors compromised the cloud backup infrastructure of enterprise IT management giant ConnectWise, using stolen integration credentials to infiltrate customer environments across approximately 2,250 organizations. ConnectWise provides remote monitoring and management (RMM) software relied upon by managed service providers worldwide.[4]
According to Microsoft’s forensic telemetry, the adversaries extracted OAuth application credentials and authentication tokens that govern automated backups between ConnectWise and client Microsoft 365 and Azure cloud tenants. Armed with these administrative keys, attackers logged into corporate directories with trusted service account privileges, harvesting executive email correspondence, cloud document repositories, and proprietary configuration databases.[4]
Critically, investigators revealed that the threat actors leveraged an open-source autonomous agent framework named ARTEX to operationalize the intrusion. By automating credential validation and lateral movement through LLM reasoning loops, the threat actor executed nearly 3,000 sign-in attempts per minute across targeted organizations. Microsoft noted that the velocity of agent-driven exploitation left defensive security operations center (SOC) analysts virtually no time to identify behavioral anomalies before critical assets were compromised.[4]
Our take: Supply-chain attacks targeting MSP software vendors are devastating because a single compromised management hub provides a master key into thousands of downstream networks. When combined with autonomous AI frameworks capable of executing 3,000 targeted sign-ins per minute, traditional human-speed incident response is completely obsolete. Enterprise IT leaders must enforce strict conditional access policies, isolate third-party backup service principals, and deploy automated identity governance that terminates high-velocity authentication bursts immediately.