Microsoft security researchers have disclosed a large-scale cyberattack attributed to a China-linked hacking group that compromised ConnectWise, a platform widely used for backing up corporate data on Microsoft-hosted infrastructure. The intrusion affected roughly 2,250 organizations and relied heavily on an open-source AI framework called ARTEX to automate credential attacks at a striking scale.
How the Attack Worked
According to Microsoft, attackers used stolen account credentials to penetrate customer environments hosted through ConnectWise's cloud backup service, then pivoted into victims' email accounts and sensitive files. The notable technical detail is the use of ARTEX, which the group deployed to automate login attempts against targeted accounts - reportedly as many as 3,000 attempts per minute. That volume of automated guessing is far beyond what human operators could execute manually, illustrating how AI tooling can compress what once took attackers weeks into a matter of hours.
Microsoft's disclosure did not detail every technical vector involved, and some specifics - including the full scope of data exposed per organization - remain unconfirmed publicly. Readers should treat the 2,250 figure and the per-minute login-attempt rate as Microsoft's reported estimates rather than independently verified totals.
A Recurring Weakness: Missing Multi-Factor Authentication
The same automated toolkit had reportedly been used previously in attacks on South Korean financial institutions, many of which lacked multi-factor authentication (MFA). That pattern is significant for IT administrators: credential-stuffing and brute-force campaigns like this one are generally far less effective against accounts protected by MFA, since a stolen password alone is insufficient to complete a login. Organizations relying solely on password-based access to cloud backup or email systems remain disproportionately exposed to this class of attack.
ConnectWise's Response and Broader Implications
In response to the breach, ConnectWise suspended access to its cloud backup services while investigating the incident, with restoration efforts reportedly underway as of October 22. The company has not published a full technical post-mortem publicly as of this writing, so the precise entry point and duration of unauthorized access remain under investigation.
The episode adds to a growing body of evidence that AI-assisted automation is lowering the barrier for executing high-volume credential attacks, a trend also seen in a separate campaign that reportedly targeted more than 1,200 websites across several countries. For enterprises and individual account holders alike, the practical takeaway is straightforward: enabling MFA, rotating credentials regularly, and monitoring for anomalous login velocity are now baseline defenses rather than optional precautions.