China-Aligned Hackers Weaponize AI Agents in Massive ConnectWise Breach Hitting Thousands of Firms

TL;DR

• Microsoft attributes a sweeping ConnectWise compromise to China-aligned actors who hijacked the IT management platform to spy on thousands of downstream MSP customers.
• The attackers used AI agents to automate reconnaissance, vulnerability discovery, and lateral movement, shrinking a weeks-long intrusion cycle to hours.
• MSPs and enterprises are urged to isolate ConnectWise instances, rotate all credentials and API keys, hunt for anomalous agent activity, and enforce phishing-resistant MFA now.

A Supply Chain Nightmare Unfolds

Microsoft's threat intelligence team says a China-aligned hacking group has breached ConnectWise, the widely used IT management giant, turning its remote monitoring and management tools into a launchpad for espionage against thousands of downstream companies.

The campaign, disclosed this week, is being described as one of the most consequential MSP supply chain attacks since SolarWinds and Kaseya. ConnectWise powers IT operations for managed service providers that collectively support hundreds of thousands of small, midsize, and enterprise businesses. By compromising upstream infrastructure, the attackers gained a trusted pathway into client networks without having to hack each victim individually.

Microsoft said the operation was focused on espionage, not ransomware, with long-term access as the primary goal.

How the Hackers Got In

According to Microsoft's breakdown, the threat actors initially exploited internet-facing ConnectWise services using a combination of a recently patched vulnerability and credential abuse. Once inside, they deployed web shells, stole authentication tokens and signing certificates, and abused legitimate remote management features to blend in with normal MSP activity.

Investigators found evidence of token replay, malicious ScreenConnect plugin abuse, and tampering with automated patching jobs to push follow-on payloads downstream. In several cases, downstream clients showed no direct signs of exploitation — only anomalous remote sessions originating from their trusted MSP.

The speed and scale of follow-on intrusions prompted Microsoft to flag the operation as highly coordinated and pre-planned.

AI Agents Did the Heavy Lifting

What sets this breach apart is the use of AI agents to accelerate exploitation.

Microsoft researchers say the attackers deployed autonomous AI-driven tooling capable of scanning thousands of ConnectWise tenants, testing exploit paths, harvesting credentials, and prioritizing high-value targets with minimal human input. The agents could adapt in real time — rewriting PowerShell and LOLBin commands when blocked, summarizing stolen data for operators, and automatically mapping trust relationships between MSPs and their clients.

One Microsoft analyst described it as industrialized intrusion: work that would have taken a human team weeks was compressed into hours. Security firms tracking the activity report similar findings, noting machine-speed lateral movement and highly convincing, context-aware phishing lures generated from previously stolen email threads.

The result was a rapid blast radius — from a single upstream foothold to suspected access across thousands of downstream firms in days.

What Data Was Targeted

This was classic state-aligned cyberespionage. Microsoft says the hackers went after identity material above all else: Entra ID tokens, Active Directory credentials, API keys for ConnectWise Automate, Control and RMM integrations, and secrets stored in IT documentation platforms.

Also targeted were client network diagrams, backup configurations, email archives, source code repositories, and data related to government, defense industrial base, telecom, and critical technology customers served by affected MSPs.

In some intrusions, attackers created persistent service accounts, enrolled their own devices for MFA, and exported mailbox data in small, slow drips to evade detection. Microsoft warns stolen MSP admin credentials could be reused for months to re-enter downstream networks even after ConnectWise itself is remediated.

ConnectWise Responds

ConnectWise said it has contained the malicious activity, rotated its own production secrets, pushed security updates, and is working with Microsoft, CISA, and third-party incident response firms to notify impacted partners.

The company is urging all partners to immediately update to the latest ScreenConnect, Automate and RMM builds, invalidate all sessions, and review audit logs dating back several months. CISA is expected to release emergency guidance and indicators of compromise, and federal officials have briefed major MSP software vendors on additional hardening steps.

ConnectWise has not disclosed exactly how many partners were directly compromised, but said the number of potentially exposed downstream end-customers could be in the thousands.

What MSPs and Enterprises Must Do Now

Security experts say MSPs should assume compromise until proven otherwise.

Immediate containment steps include taking vulnerable ConnectWise instances offline for forensic review, forcing enterprise-wide password resets, revoking and reissuing all API keys and OAuth tokens, and killing all active remote sessions.

MSPs should hunt for unfamiliar admin accounts, new ScreenConnect extensions, scheduled tasks masquerading as patch jobs, and impossible-travel logins from MSP jump hosts. Enable immutable, off-site logging, enforce FIDO2-based MFA for all technicians and clients, and segment RMM access with just-in-time privilege.

Downstream enterprises, even if they don't use ConnectWise directly, should ask their MSP for a written incident report, demand IOCs, reset shared credentials, audit third-party remote access tools, and monitor for data exfiltration to newly seen infrastructure.

What Comes Next

Microsoft warns the espionage fallout is just beginning. Even if the initial access vector is closed, the stolen credentials give the actors a durable foothold across the MSP ecosystem.

The breach is also a warning about the new era of AI-powered supply chain attacks. When AI agents can discover, exploit and scale access autonomously, a single vendor compromise can cascade faster than defenders can notify victims.

Expect more attributions, more victim notifications, and tougher regulatory scrutiny of MSP security practices in the coming weeks.

AndroGuider Team

Articles written by the AndroGuider team. We try to make them thorough and informational while being easy to read.