Chinese State‑Backed Hackers Use AI Agents to Compromise 2,250 Companies via ConnectWise Backup
Current overview (not historical)
Microsoft researchers uncovered that a Chinese state‑backed hacking group employed AI‑powered agents to infiltrate roughly 2,250 organizations by exploiting ConnectWise’s cloud backup service. The attackers stole application credentials and accessed emails and files, attempting nearly 3,000 sign‑ins per minute. In response, ConnectWise suspended its cloud backup service pending investigation. The incident highlights the growing use of AI in large‑scale credential‑stealing campaigns and the vulnerability of third‑party backup platforms to sophisticated adversaries.
Written with AI from the reporting · updated 10/22/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 22, 00:00recorded Oct 23, 00:58single sourcerevised
Chinese hackers spy on 2,250 organizations via ConnectWise b
Read original source ↗ TechCrunch · AIReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- xai
- Action：
- used to rapidly hack into organizations
- Object：
- 2,250 organizations
- Occurred (fact side)：
- Oct 22, 00:00
- Published (valid side)：
- Oct 23, 00:47
- First seen (known side)：
- Oct 23, 00:58
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- TechCrunch · AIRelated fact: single sourceSource report revisedChinese Hackers Used AI Agents to Breach ConnectWise and Target 2,250 Companies
Report first recorded Oct 23, 00:58
Security researchers at Microsoft reported that China state-aligned hackers breached ConnectWise’s cloud backup service, stealing application credentials used to link ConnectWise with its corporate customers. These credentials allowed hackers to log into customer Microsoft-hosted environments, accessing emails and files. The hackers utilized AI agents, specifically ARTEX, to rapidly hack around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute, a speed Microsoft said gives defenders little time to respond. ConnectWise has paused access to its cloud backup system and is investigating the breach.
Read original source ↗
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.