Chinese hackers spied on thousands of companies after breaching IT giant

State-aligned Chinese hackers breached ConnectWise's cloud backup service, stealing customer credentials to access corporate networks. According to TechCrunch's report, Microsoft discovered the attackers deployed automated artificial intelligence agents to penetrate Microsoft-hosted enterprise tenants, accessing emails and files across thousands of organizations.

This report details the ConnectWise backup breach, the deployment of machine learning tooling, and immediate mitigation steps. The analysis is for security teams and systems engineers managing cloud infrastructure, tenant boundaries, and SaaS backup connections. It covers the credential theft mechanics, the ARTEX framework, the attack speed, and tenant auditing.

What broke in Chinese hackers spied on thousands

The breach originated within ConnectWise's cloud backup service, where China state-aligned hackers stole critical application credentials. Enterprise customers depend on this remote management service to maintain continuous data links and back up corporate information to the cloud. By compromising the centralized backup infrastructure, the hackers obtained authentication tokens that granted administrative access into customer networks. Rather than developing complex local exploits, the intruders seized valid keys that allowed them to interact directly with client environments as if they were legitimate, authorized maintenance systems.

Armed with these stolen application credentials, the hackers bypassed traditional authentication defenses protecting Microsoft-hosted environments. The compromised tokens enabled the intruders to sign into customer cloud tenants without triggering standard credential alarms or password resets. Once inside, the threat actors operated with trusted user permissions, enabling them to inspect private corporate communications and download internal files. The breakdown in service boundary trust transformed routine administrative data channels into silent exfiltration paths, leaving client networks vulnerable to unauthorized observation across their hosted applications.

Who is exposed by Chinese hackers spied on thousands

Microsoft confirmed that the hackers breached approximately 2,250 organizations that utilized ConnectWise to manage and safeguard their operational data. Because ConnectWise provides remote access and IT management software across the technology sector, the compromise impacted a broad spectrum of commercial enterprises. Corporate clients who entrusted their data backups to the cloud service experienced unauthorized logins within their Microsoft-hosted environments. Any organization maintaining active credential connections with ConnectWise's backup platform faced potential monitoring of internal communications, operational directories, and sensitive organizational files.

The exposure specifically threatened proprietary corporate files and employee correspondence stored inside Microsoft cloud infrastructure. Because the stolen credentials impersonated trusted data backup connections, the intruders could systematically review email exchanges and extract stored documents across affected corporate tenants. Organizations relying on managed service providers were especially exposed, as administrative links often connect multiple client networks to centralized management portals. Networks lacking multi-factor authentication or granular access controls faced severe risks of silent data harvesting before the vendor suspended service access.

What to do now about Chinese hackers spied on thousands

Enterprise administrators must revoke all existing application credentials and access permissions associated with the ConnectWise cloud backup system immediately. ConnectWise paused access to its cloud backup platform while investigating the incident, but defenders must secure their individual Microsoft-hosted environments directly. Security personnel should audit registered enterprise applications, delete compromised service principal secrets, and terminate active authentication tokens. Verifying sign-in logs for unexpected access attempts and isolating affected endpoints will help ensure threat actors cannot re-enter networks using previously established administrative connections.

Organizations must also inspect tenant telemetry to detect signs of unauthorized data access or anomalous sign-in volume. Security teams should enforce multi-factor authentication across all user and administrative accounts, eliminating single-factor login weaknesses that automated tools easily exploit. Administrators should analyze historical activity logs for unusual file downloads or rapid API requests originating from unfamiliar addresses. Establishing continuous monitoring on identity infrastructure will allow defenders to intercept high-speed automated attacks and protect sensitive document repositories against future credential-based enterprise intrusion attempts.

How the Chinese hackers spied on thousands issue works

The intrusion relied on autonomous artificial intelligence agents to automate and accelerate the exploitation of stolen application credentials. According to Microsoft researchers, the attackers utilized ARTEX, an open source artificial intelligence framework designed to work with machine learning models for stress-testing cyber defenses. Instead of executing manual sign-in procedures, the hackers weaponized ARTEX to automate authentication workflows across enterprise targets. The software programmatically coordinated sign-in requests, navigated cloud permissions, and rapidly infiltrated customer tenants using the compromised ConnectWise cloud backup credentials.

This artificial intelligence automation achieved unprecedented operational speed, launching almost 3,000 sign-in attempts per minute across around 2,250 victim organizations. Microsoft noted that this extreme velocity gave enterprise defenders little time to detect anomalous activity or deploy countermeasures. The same ARTEX framework was previously deployed in a cyber compromise targeting South Korea's financial systems, where attackers exploited weak perimeter security and the lack of multi-factor authentication. In this incident, rapid automated execution enabled widespread tenant infiltration before defensive teams could intervene.

What is still unknown about Chinese hackers spied on thousands

Investigators have not disclosed the specific initial access vector that allowed hackers to compromise ConnectWise's internal cloud backup system. It remains unclear whether the attackers exploited a software vulnerability, targeted vendor employee credentials, or leveraged misconfigured cloud storage to access customer application secrets. Furthermore, neither ConnectWise nor Microsoft has published the full volume or exact sensitivity of the corporate files exfiltrated during the campaign, leaving many organizations uncertain about which proprietary documents or executive communications the intruders successfully retrieved before access was cut.

The complete timeline for service restoration and the long-term impact on ConnectWise customer deployments also remain uncertain. As of Thursday, October 22, 2026, ConnectWise stated it was actively investigating the incident and working to restore the cloud backup service, but provided no definitive relaunch schedule. Additionally, Microsoft identified the perpetrators as China state-aligned hackers but did not attribute the campaign to a specific cyber-espionage unit. Security teams are still awaiting formal technical indicators, including IP addresses and software signatures, to verify ongoing tenant safety.