Microsoft security researchers say China state-aligned hackers broke into ConnectWise’s cloud backup service and took application credentials used to connect the service with corporate customer systems. Those credentials allowed the attackers to enter Microsoft-hosted environments as authorized users and access email and other files.

Microsoft estimates that the attackers targeted about 2,250 organizations. Their tools generated almost 3,000 attempted sign-ins per minute, leaving defenders little time to detect the activity. Microsoft linked the speed to AI agents using ARTEX, an open-source framework for testing cyber defenses. The same software was involved in a recent compromise of South Korean financial systems, where many targets had weak security and no multi-factor authentication.

ConnectWise paused access to its cloud backup service and began investigating. On October 22, 2026, the company said it was working to restore the service.