A supply-chain breach with thousands of downstream victims

Microsoft security researchers say a China state-aligned hacking group broke into ConnectWise's cloud backup service and stole application credentials used to establish data links between the IT management and remote access vendor and its corporate customers. Those credentials let the attackers log in to customers' Microsoft-hosted environments as if they were authorized users, exposing email and other files. The campaign reached roughly 2,250 organizations, turning a single vendor compromise into a mass espionage event.

How the credentials became an entry point

ConnectWise is a major supplier of IT management and remote access tooling, and its cloud backup service is used by customers to back up company data. The application credentials in question are the machine-to-machine secrets that tie ConnectWise's service to a customer's Microsoft-hosted tenant, so possession of them is effectively possession of a trusted identity inside that tenant. Once the hackers held those secrets, they could authenticate to customer environments without needing to phish an employee or crack a password. That is the classic supply-chain risk for managed service providers: compromise the shared infrastructure and the blast radius extends to every customer that trusts it.

AI agents drove the sign-in storm

Microsoft attributed the scale and speed of the campaign to the use of AI agents, specifically ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. According to Microsoft, the hackers used it to attempt sign-ins at nearly 3,000 per minute across the targeted organizations, a rate the company said leaves defenders "little time to detect and respond." The same AI software was used in a recent compromise of South Korea's financial systems, many of which had weak security and lacked multi-factor authentication. The reuse of a publicly available offensive framework across separate campaigns illustrates how quickly tooling now propagates between actors and regions.

ConnectWise pauses the service as the investigation continues

ConnectWise said it has paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service. The pause cuts off a backup path for customers at the same moment they may need to check for unauthorized access, a tension that is familiar from earlier supply-chain incidents involving remote monitoring and management vendors.

What defenders should take from the incident

The technical lesson is that application credentials deserve the same protection as user passwords, including rotation, scoping and monitoring for anomalous sign-in patterns. A sign-in rate near 3,000 attempts per minute is a detectable signal if identity logs are collected and alerted on, but only if customers have visibility into the service-to-service authentications their vendors perform on their behalf. Multi-factor authentication, which was absent across many of the South Korean financial systems hit in the related campaign, remains a baseline control, though it does not fully address stolen application secrets. For IT teams, the priority is to inventory which third-party platforms hold credentials into their Microsoft environments, review what those credentials can reach, and prepare to revoke them quickly if a vendor discloses a breach. The ConnectWise case shows that vendor trust is now an attack surface measured in thousands of tenants at once.