中国黑客攻破 ConnectWise 后窃取凭据，微软称其用 AI 智能体入侵约 2250 家企业
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
AI 导读
微软安全研究人员称，与中国政府关联的黑客攻破了 IT 管理与远程访问厂商 ConnectWise 的云备份服务，窃取用于建立数据连接的应用程序凭据，随后以授权用户身份登录客户托管在微软环境中的邮箱和其他文件。
摘要与补充说明
微软表示，黑客借助 AI 智能体以每分钟近 3000 次登录尝试的速度入侵了约 2250 家组织，并称这一速度让防御方几乎没有时间检测和响应。微软将攻击速度归因于 AI 智能体，具体是一个名为 ARTEX 的开源 AI 框架，该框架与 AI 模型配合用于压力测试网络防御；同一 AI 软件也被用于近期韩国金融系统遭入侵的事件，其中许多系统安全防护薄弱且缺少多因素认证。
正文
In Brief
Posted:
9:47 AM PDT · October 22, 2026
The bad week for cybersecurity just got worse for thousands more companies, who were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise.
Security researchers at Microsoft say the China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials that are used to establish data links between ConnectWise and its corporate customers, who rely on the cloud service to backup their company’s data.
By stealing the credentials, the hackers could log in to the customer’s Microsoft-hosted environment as if they were an authorized user and access their emails and other files.
According to Microsoft, the hackers used AI agents to rapidly hack into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said this speed gives defenders “little time to detect and respond.”
The speed of the mass-hacks were attributed to the use of AI agents, specifically ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. The same AI software was used in a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication.
ConnectWise said it’s paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.