{"slug": "chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant", "title": "Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise", "summary": "China state-aligned hackers breached ConnectWise's cloud backup service and stole application credentials used to link ConnectWise with corporate customers, then used AI agents to attempt sign-ins against roughly 2,250 organizations at almost 3,000 attempts per minute, Microsoft security researchers reported on October 21, 2026. Microsoft attributed the speed to ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses and was also used in a recent compromise of South Korea's financial systems. ConnectWise said it has paused access to its cloud backup system, is investigating the breach, and as of Thursday was working on restoring the service.", "body_md": "The [bad week for cybersecurity](https://techcrunch.com/2026/10/21/the-internet-is-having-a-very-bad-cybersecurity-day/) just got worse for thousands more companies, who were spied on by Chinese hackers following the breach of IT management and remote access giant ConnectWise.\n\n[Security researchers at Microsoft say](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) the China state-aligned hackers broke into ConnectWise’s cloud backup service and stole application credentials that are used to establish data links between ConnectWise and its corporate customers, who rely on the cloud service to backup their company’s data. \n\nBy stealing the credentials, the hackers could log in to the customer’s Microsoft-hosted environment as if they were an authorized user and access their emails and other files.\n\nAccording to Microsoft, the hackers used AI agents to rapidly hack into around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said this speed gives defenders “little time to detect and respond.”\n\nThe speed of the mass-hacks were attributed to the use of AI agents, specifically ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. The same AI software was [used in a recent compromise](https://www.crowdstrike.com/en-us/blog/unknown-threat-actor-uses-artex-to-target-south-korean-finance/) of South Korea’s financial systems, many of which had [weak security](https://www.koreatimes.co.kr/business/banking-finance/20261005/ai-powered-attacks-on-banks-expose-technological-lag-in-koreas-financial-cyber-defenses) and lacked multi-factor authentication.\n\nConnectWise [said](https://www.connectwise.com/company/trust/advisories#cloudbackup) it’s paused access to its cloud backup system and is investigating the breach. As of Thursday, the company said it was working on restoring the service.", "url": "https://wpnews.pro/news/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant", "canonical_source": "https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/", "published_at": "2026-10-22 16:47:17+00:00", "updated_at": "2026-10-22 17:11:47.742826+00:00", "lang": "en", "topics": ["ai-agents", "ai-safety", "artificial-intelligence"], "entities": ["ConnectWise", "Microsoft", "ARTEX", "South Korea", "Storm-0940"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant", "markdown": "https://wpnews.pro/news/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant.md", "text": "https://wpnews.pro/news/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant.txt", "jsonld": "https://wpnews.pro/news/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant.jsonld"}}