Microsoft ties ConnectWise breach to China-aligned group using AI agents

Microsoft says a China-aligned hacking group turned a breach at ConnectWise into a shortcut into about 2,250 customers’ Microsoft 365 environments. The attackers stole credentials from ConnectWise’s cloud-backup application—digital keys that customers had already authorized—then used an AI-agent tool to test access and carry out follow-on steps at a speed people could not match. Microsoft says most targets were not successfully breached, but the group gained high-level, persistent cloud access at a number of organizations, sometimes within three hours; it cautioned that a successful login alone does not prove files were taken. ConnectWise has cut off affected app connections while it investigates and restores the service, showing how one trusted software link can turn a supplier breach into broad customer exposure.