Chinese hackers aligned with the Chinese state hacked into IT management firm ConnectWise’s cloud backup services, leading to a large-scale espionage operation. Security experts at Microsoft revealed the attackers stole application credentials that allowed them to access thousands of ConnectWise customers’ Microsoft-hosted environments as if they were authorized users. This breach enabled the hackers to spy on emails and other sensitive files across approximately 2,250 organizations.

The cybercriminals used advanced AI tools to accelerate their attacks, relying on an open-source AI framework called ARTEX. This technology allowed them to carry out nearly 3,000 sign-in attempts per minute, overwhelming defenders and minimizing the window for companies to detect and respond to the intrusion. ARTEX, which works alongside AI models, had also been implicated in recent attacks on South Korea’s financial institutions where security measures were weaker.

ConnectWise responded by temporarily halting access to its cloud backup system and launching an investigation into the breach. As of October 22, 2026, the company was actively working on restoring services while analyzing the full scope of the attack’s impact on its client base. This incident highlights the growing risks facing IT service providers that manage critical infrastructure and customer data.

Microsoft’s findings stress the escalating role of AI in cyberattacks and the vulnerabilities in supply chain software platforms. It underscores the urgent need for companies to adopt stronger authentication methods such as multi-factor authentication. The ConnectWise breach serves as a cautionary tale about how attacks on service providers can propagate rapidly, affecting thousands of downstream organizations simultaneously.