Microsoft says China-aligned hackers spied on about 2,250 organizations

Microsoft security researchers say China state-aligned hackers breached ConnectWise’s cloud backup service and stole credentials used to connect it with corporate customers. Microsoft says the credentials allowed the group to access Microsoft-hosted environments as an authorized user, potentially viewing emails and other files at about 2,250 organizations. The attacks reached nearly 3,000 attempted sign-ins per minute, a speed the company says left defenders little time to detect and respond.

Microsoft attributed the rapid attacks to the use of AI agents, specifically ARTEX, an open-source framework for stress-testing cyber defenses. ConnectWise said it paused access to its cloud backup system, was investigating the breach and was working to restore the service.