Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise

According to Microsoft, China state-aligned hackers broke into ConnectWise's cloud backup service and stole application credentials that link ConnectWise to its corporate customers. With those, they could log in to customers' Microsoft-hosted environments as authorized users and reach emails and files.

Microsoft says the attackers used AI agents to hit around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute, leaving defenders little time to respond. ConnectWise paused access to the backup system and, as of Thursday, said it was working to restore service.

This is the supply-chain nightmare security teams have warned about, with a new accelerant. Breaching one trusted IT provider has always been the efficient way into thousands of companies. What changes here is the tempo. Microsoft attributes the speed to ARTEX, an open-source AI framework built to stress-test defenses, which reportedly was also used in a recent compromise of South Korean financial systems, many of them lacking multi-factor authentication.

We want to be careful not to blame the tool for the intent. Red-team frameworks exist because defenders need them, and AI-assisted testing is genuinely useful. But this is the pattern we keep seeing this month: the same automation that helps defenders find weaknesses collapses the time attackers need to exploit them. When attempts arrive at thousands per minute, a human-paced incident response playbook is already behind.

The lesson for most organizations isn't exotic. Long-lived application credentials held by third parties are a standing risk, and they deserve the same scrutiny as employee passwords: scoped narrowly, rotated, and watched for unusual sign-in volume. Customers who rely on ConnectWise backups also now face the uncomfortable fact that the service meant to protect their data was the door.

Where this leads if it scales is clear enough. Expect more attackers to target service providers and integration tokens, and expect AI agents to turn every stolen key into a mass campaign within minutes. Defenders will need automated detection and automatic credential revocation that move at the same speed. I'm watching how quickly Microsoft and ConnectWise can tell affected customers exactly what was accessed.

This lands in an already rough week for security, following a widely reported spate of incidents including newly disclosed PHP vulnerabilities and a cyberattack that led developer platform Railway to urge all users to revoke secret keys. ConnectWise is a major provider of IT management and remote access tools used by managed service providers and businesses.