Chinese Hackers Breached IT Giant ConnectWise, Spying on 2,250 Organizations Using AI

Chinese state-aligned hackers compromised IT management and remote access company ConnectWise, using AI tools to rapidly infiltrate around 2,250 of its corporate customers, Microsoft researchers revealed on October 22, 2026.

According to Microsoft, the hackers broke into ConnectWise’s cloud backup service and stole application credentials used to establish data links between ConnectWise and its customers. With those credentials, the attackers were able to log into customer Microsoft-hosted environments as authorized users, gaining access to emails and other files.

The scale and speed of the attack were enabled by ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses. The hackers used ARTEX-powered AI agents to attempt nearly 3,000 sign-ins per minute across victim organizations. Microsoft noted that this pace gives defenders “little time to detect and respond.”

ARTEX has been linked to at least one other major incident — a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication.

ConnectWise said it has paused access to its cloud backup system and is actively investigating the breach. As of Thursday, the company said it was working to restore the service.

The incident highlights a growing concern for businesses that rely on third-party IT providers: a single breach of a widely used platform can expose thousands of downstream customers simultaneously. The use of AI agents to automate credential attacks at this scale may suggest that defenders will need to respond at comparable speeds to contain future intrusions.