ConnectWise Breach Lets Chinese Hackers Spy on 2,250 Companies With ARTEX AI
Chinese state-aligned hackers breached ConnectWise, stole cloud backup credentials and used ARTEX AI to target about 2,250 customer Microsoft environments.
Summary
On October 22, 2026, Microsoft researchers said China state-aligned hackers breached ConnectWise’s cloud backup service and stole application credentials linking the IT management and remote access provider with corporate customers backing up company data. The credentials let attackers enter customers’ Microsoft-hosted environments as authorized users, exposing emails and other files.
Using ARTEX, an open source AI framework designed to stress-test cyber defenses, the hackers compromised around 2,250 organizations while generating almost 3,000 attempted sign-ins per minute, leaving defenders little response time. ARTEX was also used in a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multifactor authentication. ConnectWise paused cloud backup access, began investigating and, as of Thursday, was working to restore service.
Positives
- Microsoft researchers identified the stolen-credential campaign, its scale and the ARTEX framework used by the attackers.
- ConnectWise paused access to its cloud backup system after discovering the breach.
- ConnectWise began investigating the intrusion and was working to restore service as of Thursday.
- ARTEX was originally designed to help organizations stress-test their cyber defenses.
Risks & concerns
- Around 2,250 organizations were compromised after attackers stole ConnectWise application credentials.
- Almost 3,000 attempted sign-ins per minute gave defenders little time to detect and stop the attacks.
- Stolen credentials let hackers enter Microsoft-hosted environments as authorized users and access emails and other files.
- ARTEX enabled rapid, automated intrusion attempts and was also used against South Korea’s financial systems.
- Many affected South Korean financial systems had weak security and lacked multifactor authentication.