Chinese hackers target thousands of companies via ConnectWise breach

State-sponsored hackers from China have compromised ConnectWise cloud backup services, targeting approximately 2,250 organizations. According to security researchers at Microsoft, the attackers stole application credentials used to link management tools to client servers, allowing them to access victims' Microsoft environments as authorized users.

The attack was characterized by its extreme speed, utilizing AI agents to automate access attempts at a rate of nearly 3,000 connections per minute. This high cadence was designed to saturate the reaction time of security teams and bypass traditional detection and validation procedures. The breach provided attackers with access to sensitive data, including emails and various files within the compromised environments.