Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
News Source
โขThu, 22 Oct 2026 16:47:17 +0000
๐ฐ What Happened
Hackers linked to China broke into ConnectWise, a company many businesses use to manage their computers and remote access. Microsoft researchers say the hackers then spied on thousands of ConnectWise customers.
The hackers stole login keys from ConnectWise's cloud backup service. With those keys, they could sign in to customer systems as if they were real users. That gave them access to emails and other files.
Microsoft says the attackers reached about 2,250 organizations, trying almost 3,000 sign-ins every minute.
๐ The Backstory
Microsoft says the group used AI agents to move that fast. The tool was ARTEX, an open AI framework built to test cyber defenses. Running it at machine speed leaves defenders almost no time to notice and react.
The same AI software was used in a recent attack on South Korea's financial systems. Many of those systems had weak security and no two-step login checks.
ConnectWise has paused its cloud backup service and says it is still investigating the breach.
๐ฏ Why It Matters
Your bank, school, or workplace may rely on a supplier like ConnectWise. One weak link can expose the private data of thousands of other companies.
Hackers linked to China broke into ConnectWise, a company many businesses use to manage their computers and remote access. Microsoft researchers say the hackers then spied on thousands of ConnectWise customers.
The hackers stole login keys from ConnectWise's cloud backup service. With those keys, they could sign in to customer systems as if they were real users. That gave them access to emails and other files.
Microsoft says the attackers reached about 2,250 organizations, trying almost 3,000 sign-ins every minute.
Microsoft says the group used AI agents to move that fast. The tool was ARTEX, an open AI framework built to test cyber defenses. Running it at machine speed leaves defenders almost no time to notice and react.
The same AI software was used in a recent attack on South Korea's financial systems. Many of those systems had weak security and no two-step login checks.
ConnectWise has paused its cloud backup service and says it is still investigating the breach.
Your bank, school, or workplace may rely on a supplier like ConnectWise. One weak link can expose the private data of thousands of other companies.