Chinese State‑Backed Hackers Exploit ConnectWise Backup Service Using AI Agents

Microsoft’s threat intelligence team disclosed that a China‑aligned group breached ConnectWise’s cloud backup service, extracting application credentials that link the provider to its corporate customers. With those tokens the intruders could masquerade as authorized users inside the victims’ Microsoft‑hosted environments, gaining access to email, files and other sensitive data.

AI‑Accelerated Credential Stuffing

The attackers leveraged ARTEX, an open‑source AI framework designed for stress‑testing cyber defenses, to automate credential‑stuffing at massive scale. The operation hit roughly 2,250 organizations, firing almost 3,000 sign‑in attempts per minute — a pace that leaves defenders with minimal detection and response windows.

ConnectWise has suspended access to its backup platform while it investigates and works to restore service. The incident underscores how readily available AI tooling can turn a single credential leak into a rapid, large‑scale compromise.

Why it matters for GPU / AI infrastructure: The same high‑performance GPU clusters that power legitimate AI workloads also enable adversaries to run massive parallel login campaigns. Cloud providers and GPU‑as‑a‑service platforms must enforce strict credential hygiene, multi‑factor authentication and real‑time anomaly detection to blunt such automated attacks.