Chinese state-aligned hackers used AI agents after breaching ConnectWise cloud backup
Microsoft researchers say China state-aligned hackers breached ConnectWise’s cloud backup service, stole application credentials that let them log into customers' Microsoft-hosted environments, and used AI agents (identified as ARTEX) to attempt about 3,000 sign-ins per minute, rapidly targeting roughly 2,250 organizations. ConnectWise has paused access to the backup service and is investigating; Microsoft reports ARTEX was previously used in attacks on South Korea’s financial systems.