China state-aligned hackers reportedly spied on thousands of companies after compromising ConnectWise, using access to the IT provider’s cloud backup service to reach its corporate customers. Microsoft security researchers said the attackers stole application credentials and deployed artificial intelligence agents to carry out the subsequent intrusions rapidly. ConnectWise has suspended access to the affected backup system while investigating the breach and working to bring the service back online.

Microsoft put the number of organisations breached at around 2,250 and said the attackers operated at almost 3,000 attempted sign-ins per minute. Those figures describe different aspects of the operation: the reported reach of the intrusions and the pace of attempts to gain access. The sign-in rate is not a count of successful compromises. Together, however, the figures indicate an attack that combined access through a shared service provider with rapid execution against its customers.

The starting point was ConnectWise’s cloud backup service, which corporate customers use to back up their business data. According to Microsoft, the stolen credentials were used to establish data connections between ConnectWise and those customers. Their theft therefore gave the attackers a means of moving beyond the provider itself. The reported sequence places the credentials at the centre of the breach: access intended to support a backup service became the route into customer organisations.

Read more: PHP flaws spur patching effort as Wiz estimates roughly 70% of internet affected

ConnectWise provides IT management and remote-access services, but the reported intrusion concerned its cloud backup operation. That distinction matters in assessing the scope of the incident. Microsoft’s account identifies a particular service and the application credentials associated with its customer connections, rather than describing a compromise of every ConnectWise product. The customer exposure reported by Microsoft followed from that access, making the relationship between the backup provider and its users central to understanding how the attack spread.

Microsoft attributed the speed of the customer intrusions to AI agents using ARTEX, an open-source framework that works with AI models to test cyber defences. In the reported attacks, the technology helped hackers carry out intrusions rapidly. The account describes AI as a tool supporting the operation, alongside stolen credentials. It does not make the credentials incidental: they supplied the access that the agents then helped the hackers exploit.

The rate of almost 3,000 attempted sign-ins per minute is particularly relevant to the response challenge. Microsoft said that speed left defenders with a sharply reduced opportunity to identify the activity and react. The significance is therefore not simply the number of attempts, but the limited response window associated with their pace. The reported rate should still be read as attempted authentication activity, rather than as evidence that each attempt opened a different organisation or system.

Read more: Russian strikes kill 7 in Ukraine amid push to resume peace talks

ARTEX has also been used in a recent compromise of South Korea’s financial systems, many of which had weak security. That provides another example of the same AI framework appearing in an attack, although the shared technology does not by itself establish that the incidents involved the same perpetrators. In the ConnectWise case, Microsoft identified the hackers as aligned with the Chinese state. The framework’s use is a separate issue from that assessment of who conducted the operation.

ConnectWise’s stated response has included suspending access, investigating the breach and working to restore service. The company said it had paused access to its cloud backup system and was investigating the breach. As of Thursday, October 22, 2026, it said work to restore the service was continuing. The suspension means the incident involves both reported intrusions into customer organisations and an interruption to the backup service those customers rely on. Restoration remained work in progress in the company’s statement that day.

Microsoft’s findings and ConnectWise’s statement address different parts of the same incident. The researchers described the attackers, their methods and the scale of customer compromises; the company outlined its operational response. The figure of around 2,250 organisations should consequently remain attributed to Microsoft, rather than presented as ConnectWise’s own assessment. Similarly, the description of Chinese state alignment is the researchers’ attribution. Keeping those accounts distinct avoids implying that the company has independently confirmed every detail of Microsoft’s findings.

ConnectWise said it was investigating the breach and working to restore the cloud backup service. Microsoft’s account puts the stolen application credentials and the speed of AI-assisted attacks at the centre of the security problem. Restoring availability addresses the service interruption, while the investigation concerns how the breach occurred. The incident illustrates the consequences of compromising connections between a provider and its customers, with Microsoft’s reported scale showing how far an intrusion at the provider can extend.