Chinese hackers targeted thousands of companies with ConnectWise leak

State-sponsored Chinese hackers gained unauthorized access to the data of thousands of companies by breaching the cloud backup service of IT management and remote access giant ConnectWise. According to Microsoft security researchers, the theft of application credentials used to establish data connections between company customers and ConnectWise allowed the hackers to log in as authorized users and review emails and files.

Microsoft reported that the attackers rapidly infiltrated approximately 2,250 organizations using about 3,000 login balance attempts per minute and an open-source AI framework named ARTEX. This high speed reportedly made it difficult for defense mechanisms to detect and respond. A similar AI software was stated to have been used in a recent breach targeting South Korea's financial systems, which had weak security and lacked two-factor authentication. ConnectWise announced that it has suspended access to the cloud backup system, is investigating the leak, and is working to restore the service.