Microsoft researchers say attackers stole application credentials from ConnectWise's cloud backup service and used them to sign in to customers' Microsoft-hosted environments, reaching emails and files at roughly 2,250 organisations. The attackers reportedly used AI agents built on the open-source ARTEX framework, at close to 3,000 sign-in attempts a minute. ConnectWise suspended cloud backup access while it investigates. ConnectWise is widely used by managed service providers, so UK firms relying on MSPs may want to check their exposure.
