ConnectWise Breach Shows AI Agents Hacking at Machine Speed

The ConnectWise breach just became the clearest example yet of what happens when hackers hand the boring parts of a cyberattack to artificial intelligence. Microsoft says a China-aligned crew used AI agents to try its way into more than two thousand two hundred fifty business accounts, firing off almost three thousand sign-in attempts every single minute.

What Microsoft says happened

According to TechCrunch, the hackers broke into ConnectWise's cloud backup service and stole application credentials. Those credentials normally set up the data links between ConnectWise and the companies that rely on it to back up their files. With them in hand, the attackers could log in to a customer's Microsoft-hosted environment as if they were an authorized user, then reach emails and other files.

ConnectWise is an IT management and remote access giant, the kind of vendor that smaller companies hire so they do not have to run their own tech departments. That is exactly why the ConnectWise breach matters so much. One compromised vendor can open doors into thousands of organizations at once, which security people call a supply chain attack.

Microsoft's own security blog pins the campaign on a state-aligned group it tracks as Storm-0940. Microsoft assesses that the group was responsible for the supply chain compromise of a multi-tenant application, and it says the activity did not come from any flaw in its own products or corporate systems.

The AI agents doing the heavy lifting

The speed is the headline here. According to Microsoft, the attackers leaned on ARTEX, an open source framework that pairs with AI models and was built to stress-test cyber defenses. Security teams use tools like it to probe their own networks. The hackers flipped that idea around and pointed it at strangers.

Reporting from The Register explains that the framework automates everything from reconnaissance and vulnerability discovery to credential attacks and data theft. Microsoft says the group started using it as early as September, and that in some cases the hackers went from picking a target to holding privileged cloud access in less than three hours.

Microsoft warned that this pace leaves defenders with little time to detect and respond. A human analyst reading logs simply cannot keep up with a machine that tries thousands of logins a minute and never gets bored. That gap between attacker speed and defender speed is what worries the industry most.

Who was targeted and how far it got

The Register reports that the group has targeted government agencies, defense contractors, banks, manufacturers and tech firms. Between the tenth and fourteenth of October, a separate password-spraying run hit three hundred twenty-seven accounts at eight organizations with more than one hundred fifty-one thousand failed sign-ins. Microsoft saw no successful logins from that particular run, which is a small piece of good news.

After that, the attackers shifted to the stolen ConnectWise application identities. Microsoft observed activity through Microsoft Graph, including reconnaissance and changes to application credentials and privileges. Those moves can let intruders stay put even after the original credentials are revoked, so a quick password reset does not always end the problem.

Most of the attempts failed, but not all of them. Microsoft says the hackers still established persistent privileged access at numerous organizations. It has not said how many customers were actually compromised or whether data was taken, and it cautioned that a successful sign-in does not automatically mean information was accessed.

What ConnectWise is doing about it

ConnectWise disclosed the incident in an advisory and pulled several cloud services offline while it investigated, including Cloud Backup, SaaS Security and Cloud Management. TechCrunch notes the company paused access to its cloud backup system, and that as of Thursday it was working on restoring the service. CEO Manny Rivelo said the affected application connections had been contained and services were coming back gradually.

There is a catch, though. The Register points out that shutting down those connections does not necessarily boot out attackers who already built a foothold inside customer environments. Customers who ever trusted a ConnectWise cloud app are being urged to review app permissions, rotate keys and check for unexpected administrator changes.

This is also not the vendor's first run-in with nation-state hackers. In May of last year, ConnectWise admitted a sophisticated nation-state actor had broken into its systems and affected a small number of customers using its ScreenConnect remote access software. Nothing suggests the two incidents are linked.

Why this one matters beyond one vendor

ARTEX is freely available, and Microsoft says attackers from several regions are already using it. TechCrunch adds that the same software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication. In other words, the tool is spreading fast, and the techniques underneath it are old: stolen credentials, password spraying and app abuse.

The new twist is that AI makes those old tricks cheap and quick enough to run at massive scale. For anyone who works in tech, studies it, or just stores everything in the cloud, the lesson is practical. Turn on multi-factor authentication, audit which third-party apps can touch your accounts, and treat every vendor connection as a possible front door.

For more on how machines are reshaping the threat landscape, browse the tech section on GenZ NewZ. The ConnectWise breach will almost certainly not be the last time an automated attacker outruns the people trying to stop it.