Overview
A China state-aligned threat actor has compromised IT management and remote access provider ConnectWise, using the foothold to spy on approximately 2,250 of its corporate customers. Microsoft security researchers attribute the breach to the theft of application credentials from ConnectWise’s cloud backup service, which were then weaponised to authenticate into victim Microsoft-hosted environments as legitimate users. The attack is notable not only for its scale but for the confirmed use of an AI agent framework — ARTEX — to automate and accelerate the intrusion campaign.
Technical Analysis
The attack chain followed a classic supply-chain pivot: by compromising a trusted upstream vendor (ConnectWise), the attackers inherited implicit trust relationships with thousands of downstream corporate customers. Stolen application credentials eliminated the need for phishing or vulnerability exploitation at the target layer — attackers simply authenticated as authorised users.
The velocity of the campaign is the most operationally significant detail. Microsoft reported approximately 3,000 attempted sign-ins per minute, a rate that Microsoft explicitly states leaves defenders “little time to detect and respond.” This speed was enabled by ARTEX, an open-source AI framework designed to stress-test cyber defences by coordinating AI models to execute multi-step attack workflows autonomously.
ARTEX functions as an orchestration layer for AI agents, allowing a small number of operators to direct large-scale, parallelised credential-stuffing and authentication campaigns without manual intervention at each step. The same tooling was previously observed in a compromise of South Korean financial systems, where weak security posture and absent MFA amplified impact.
Framework Mapping
- AML.T0103 – Deploy AI Agent: ARTEX was deployed to autonomously execute sign-in attempts at scale across thousands of target environments.
- AML.T0010 – AI Supply Chain Compromise: ConnectWise served as a trusted intermediary whose compromise propagated to thousands of downstream organisations.
- AML.T0012 – Valid Accounts: Stolen application credentials were used to authenticate as legitimate users, bypassing perimeter defences.
- AML.T0086 – Exfiltration via AI Agent Tool Invocation: AI agents likely orchestrated data access (emails, files) once authenticated sessions were established.
- LLM08 – Excessive Agency: ARTEX exemplifies the risk of AI agents operating with broad, automated authority over sensitive systems with minimal human oversight.
- LLM05 – Supply Chain Vulnerabilities: The breach propagated through a trusted vendor relationship, consistent with supply chain risk in AI-enabled service ecosystems.
Impact Assessment
Approximately 2,250 organisations had their Microsoft-hosted environments accessed without authorisation. Exposed data includes corporate email and files — high-value targets for espionage. The South Korean financial sector precedent suggests this tooling is being refined and reused across geopolitical targets. Organisations without MFA were disproportionately affected.
Mitigation & Recommendations
- Rotate credentials immediately: All ConnectWise cloud backup application credentials and API tokens must be treated as compromised and replaced.
- Enforce MFA universally: Multi-factor authentication should be mandatory across all Microsoft-hosted services and remote access tooling — absence of MFA was a key enabler in both this and the South Korean incident.
- Review authentication telemetry: Hunt for high-velocity sign-in patterns, especially from unfamiliar IP ranges or at unusual hours, which are indicators of automated credential abuse.
- Govern AI agent deployments: Organisations evaluating or running open-source AI agent frameworks should enforce least-privilege constraints and audit tool invocation logs.
- Suspend affected services: Follow ConnectWise’s lead in pausing access to compromised services until integrity can be verified.