中国黑客攻破 ConnectWise 后监视数千家企业
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
微软称，与中国有关联的黑客入侵 ConnectWise 云备份服务并窃取应用凭据，随后借此访问客户的 Microsoft 托管环境，查看邮件及其他文件。微软称，攻击者使用 AI 智能体快速入侵约 2,250 个组织，登录尝试速度接近每分钟 3,000 次。ConnectWise 已暂停云备份系统访问并调查事件，当时正着手恢复服务。
事件呈现了云备份凭据被盗后波及客户环境的攻击路径，也说明 AI 智能体可将大规模登录尝试压缩到极短时间内。
In Brief
Posted:
9:47 AM PDT · October 22, 2026
The bad week for cybersecurity just got worse for thousands more companies, who were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise.
Security researchers at Microsoft say the China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials that are used to establish data links between ConnectWise and its corporate customers, who rely on the cloud service to back up their company’s data.
By stealing the credentials, the hackers could log in to the customer’s Microsoft-hosted environment as if they were an authorized user and access their emails and other files.
According to Microsoft, the hackers used AI agents to rapidly hack into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said this speed gives defenders “little time to detect and respond.”
The speed of the mass-hacks was attributed to the use of AI agents, specifically ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses. The same AI software was used in a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication.
ConnectWise said it’s paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.
来源：TechCrunch · AI · techcrunch.com