Chinese hackers spy on 2,250 organizations with AI after ConnectWise breach

What this is about

State-linked Chinese hackers broke into ConnectWise's cloud backup service and then spied on thousands of companies, according to Microsoft security researchers. ConnectWise is a major provider of IT management and remote access software. Its products are widely used by IT service providers who look after other companies' computers. TechCrunch reported on it on October 22, 2026. The source is brief. It gives no details on the time frame, the amount of data taken or who exactly is behind the attack.

How the attack worked

According to Microsoft, the attackers breached ConnectWise's cloud backup service. There they stole application credentials. These are digital keys that let programs and services connect to each other without a human typing in a password. ConnectWise uses them to set up data connections to its business customers, who back up their data there.

With the stolen keys, the hackers could log in to customers' Microsoft-hosted environments as if they were legitimate users. That gave them access to emails and other files. It works like a master key: steal it from the service provider, and you can get into many customers.

The use of AI agents

Microsoft says the attackers used AI agents. These are programs that use AI models to work through tasks largely on their own. With them, the attackers got into around 2,250 organizations, with nearly 3,000 login attempts per minute. According to Microsoft, that speed leaves defenders "little time to detect and respond."

The report names ARTEX, an open-source AI framework that works with AI models and is actually meant for testing cyber defenses (stress testing). According to the report, the same software was also used in a recent breach of South Korea's financial systems. Many of the targets had weak security and no multi-factor authentication, meaning no second confirmation on top of the password.

ConnectWise's response

ConnectWise has paused access to its cloud backup system and is investigating the incident. On Thursday, the company said it was working to bring the service back online. TechCrunch opens its report by noting that it was already a bad week for cybersecurity.

Our take

The case highlights two risks. First, attacking a service provider (a supply chain attack) is especially effective, because one breach affects thousands of customers. Second, it shows how AI agents speed up attacks. Tools built for security testing can apparently be used for attacks as well. Note, however, that the claims about the Chinese state link and the use of AI come from Microsoft. The source cites no independent confirmation. It also remains unclear what data was actually taken, how long the access lasted and which customers are affected. If you use ConnectWise backup, you should review and rotate credentials and check your sign-in logs. That is general advice, not something stated in the source.