Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise

ConnectWise is an IT management and remote access giant. Its cloud backup service helps corporate customers back up company data. Because the service connects to many separate businesses, compromising it can create consequences far beyond ConnectWise itself.

Microsoft researchers said hackers stole application credentials from ConnectWise’s cloud backup service. Those credentials establish data links between ConnectWise and customer environments. The hackers could then sign in to customers’ Microsoft-hosted environments as authorized users and reach emails and other files.

ConnectWise paused access to its cloud backup system and began investigating. The company was working to restore the service as of Thursday. The incident shows why a provider that stores or connects to many customers’ data can become a high-value target: one stolen set of access tools may affect thousands of organizations.

Microsoft said the hackers used AI agents to rapidly attack around 2,250 organizations. Their automated campaign attempted almost 3,000 sign-ins per minute. This was not a slow, company-by-company intrusion; it was a mass operation moving at machine speed.

The sign-ins used stolen application credentials from ConnectWise’s cloud backup service. Those credentials could make the attackers appear to be authorized users in customers’ Microsoft-hosted environments. Once inside, they could access emails and other files. The article links the campaign’s rapid pace to ARTEX, an open source AI framework used with AI models to stress-test cyber defenses.

Microsoft warned that this speed gives defenders little time to detect and respond. The scale also means one compromised provider can produce many simultaneous security incidents. ConnectWise paused cloud backup access while investigating, but the article does not state how many organizations were successfully entered.

Application credentials are access details used by software to connect one service to another. In this case, they established data links between ConnectWise and its corporate customers. Stealing them gave the hackers a way to imitate an approved connection rather than starting with an obvious unauthorized login.

Microsoft said the hackers could log in to customers’ Microsoft-hosted environments as if they were authorized users. From there, they could access emails and other files. The key mechanism was trust: the customer environment recognized the stolen credentials as valid for the connection between systems.

The article does not specify whether every credential had identical permissions or how many files were accessed. It does show why application credentials require strong protection. ConnectWise paused access to its cloud backup service and investigated the breach, while the company worked to restore the service.

China state-aligned hackers are attackers described as connected to, supported by, or acting in line with Chinese government interests. “Aligned” does not necessarily identify a specific agency, command structure, or individual. The article uses this label for the group that breached ConnectWise’s cloud backup service.

The reported activity involved stealing application credentials and using them to enter customers’ Microsoft-hosted environments. Microsoft also said the hackers used AI agents to target around 2,250 organizations. The article names ARTEX, an open source AI framework used with AI models, as the software linked to the campaign’s speed.

The article does not provide names, motivations, or operational details for the hackers beyond describing them as China state-aligned. It also does not say that China’s government publicly claimed responsibility. The important reported point is the combination of a government-aligned threat label, stolen credentials, and rapid attacks across many organizations.

An IT provider can become a gateway because many businesses depend on its software, remote access, backups, or data connections. The provider’s systems may hold credentials that connect each customer’s environment to a central service. That creates a concentration of trust in one place.

The ConnectWise incident illustrates the mechanism. Hackers broke into its cloud backup service and stole application credentials used for data links with corporate customers. Microsoft said those credentials could let attackers enter customers’ Microsoft-hosted environments as authorized users, where they could access emails and other files.

This structure makes the provider a high-value target. A single intrusion can potentially create access paths to many organizations instead of just one. The article reports that around 2,250 organizations were targeted. ConnectWise paused its cloud backup service while investigating, showing how one provider’s response can affect all connected customers.

Multi-factor authentication, or MFA, asks users or systems for an additional proof beyond a password or credential. Limiting permissions means each credential can access only the services and data it genuinely needs. These are standard security measures; the article specifically notes that weak security and missing MFA contributed to a recent South Korean compromise.

If stolen application credentials require another verification step, attackers may be unable to use them alone. If the credentials have narrow permissions, successful attackers may reach fewer files or systems. Organizations can also rotate credentials, monitor unusual sign-ins, and quickly disable exposed connections. These measures are general security practices, not additional actions reported from this incident.

They cannot guarantee safety, but they can reduce the value of stolen credentials. That matters when AI agents attempt nearly 3,000 sign-ins per minute. Stronger barriers and narrower access could give defenders more time to detect, block, and investigate the activity.

Cloud services are online computing, storage, or software resources provided over a network instead of running entirely on a local device. Application credentials are passwords, keys, or tokens that let one software service authenticate to another. The article says ConnectWise’s cloud backup service used such credentials to establish data links with customers.

AI agents are software systems that can use AI models to carry out tasks with limited step-by-step human direction. In this incident, Microsoft said AI agents helped hackers attempt sign-ins rapidly. It linked the speed to ARTEX, an open source AI framework that works with AI models to stress-test cyber defenses.

These technologies can automate useful connections and workflows, but compromised credentials can let automation move through trusted links. The article reports almost 3,000 attempted sign-ins per minute. That speed gives defenders little time to detect and respond, especially when one provider connects to many customers.