Microsoft says China-aligned hackers used AI agents to breach about 2,250 organizations via credentials stolen from ConnectWise's cloud backup service

TechCrunch reports that Microsoft says China-aligned hackers broke into ConnectWise's cloud backup service and stole application credentials that link ConnectWise to customers' Microsoft-hosted environments. The attackers used those credentials to sign in as authorised users and read emails and files at about 2,250 organisations, at nearly 3,000 attempted sign-ins per minute. Microsoft puts that speed down to an open source AI agent framework called ARTEX, which it says was also used in a recent compromise of South Korean financial systems. ConnectWise paused access to its cloud backup system, is investigating, and was working on restoring the service as of Thursday.

ConnectWise customers, mainly IT service providers and the businesses they support, are the group at risk. They should check whether their ConnectWise-to-Microsoft connections were exposed, rotate the affected credentials and review sign-in logs for unfamiliar activity. The wider lesson is not new: stolen credentials from a trusted supplier let attackers walk in as legitimate users. If the AI claim holds, it shortens the time defenders have to spot and stop this kind of access, but the evidence for that is thin so far. The scale (2,250 organisations) is serious whether or not AI was involved.

The AI angle rests on one source, Microsoft, and the brief links to no report, so nobody has independently checked it. About 3,000 sign-in attempts a minute is not unusual for automated credential abuse, so speed alone does not prove AI agents were driving it. "Already a bad week for cybersecurity" is framing, not information, and it is unclear how many of the 2,250 organisations were actually accessed rather than targeted, or what data was taken.

1. 01Publication of Microsoft's own technical report, and whether it gives evidence for ARTEX's role such as logs, behaviour patterns or tooling details, rather than only asserting it.
2. 02ConnectWise's investigation findings and service restoration: how the backup service was breached, how many customers were affected, and whether credentials were forced to rotate.
3. 03Independent confirmation from other security firms or government agencies (such as CISA or the NCSC) of the ARTEX link to the South Korean incident and to this attack.