Suspected Chinese state hackers breach ConnectWise ScreenConnect to infiltrate 2,250 corporate networks
Microsoft Threat Intelligence reveals attackers weaponized the open-source ARTEX AI framework to attempt 3,000 automated logins per minute across compromised MSPs.
Technology news
Suspected Chinese state-sponsored hackers compromised enterprise IT management and remote support provider ConnectWise, stealing administrative credentials to infiltrate approximately 2,250 downstream corporate networks and managed service providers (MSPs).[3]
According to a security bulletin issued by Microsoft Threat Intelligence, the threat group gained unauthorized access to ConnectWise's cloud backup infrastructure, extracting administrative application keys that maintain automated data synchronizations with customer Microsoft 365 and cloud tenants. With credentials in hand, the intruders accessed corporate inboxes, executive documents, and privileged identity stores without triggering traditional anomaly alarms.[3]
Microsoft researchers noted that the attackers automated their intrusion campaign using ARTEX, an open-source AI agent framework originally designed for red-team adversarial simulation. By leveraging autonomous agent workflows, the threat actors conducted sign-in attempts at an unprecedented velocity of nearly 3,000 requests per minute across target domains, leaving enterprise security operations centers virtually no time to detect or isolate active sessions before data exfiltration commenced. ConnectWise has since severed external access to its cloud backup system while forensic investigations continue.[3]
Our take: The ConnectWise intrusion signals a dangerous maturation in supply-chain cyber warfare: the weaponization of open-source AI agent tooling to execute automated attacks at machine speed. When state-sponsored actors pair stolen administrative trust credentials with autonomous decision-making agents, human incident responders operating on manual triage workflows are mathematically outmatched. Zero-trust architecture with mandatory hardware-backed MFA is no longer optional for remote IT tooling.