China state-aligned hackers breach ConnectWise, use AI to spy on 2,250 organizations
Microsoft researchers discovered that China state-aligned hackers infiltrated ConnectWise, an IT management and remote access provider, stealing application credentials to access customer environments. The attackers used an AI-driven framework to breach around 2,250 organizations at an unprecedented scale and speed.
Editor, Lazyfounder
TABLE OF CONTENTS
KEY HIGHLIGHTS
- China state-aligned hackers breached ConnectWise, an IT management and remote access provider, stealing application credentials to spy on thousands of corporate customers.
- Hackers used an AI framework called ARTEX to execute around 2,250 breaches at a rate of 3,000 attempted sign-ins per minute.
- ConnectWise has paused access to its cloud backup system and is investigating the incident.
- ARTEX was also linked to a recent compromise of South Korea’s financial systems, which lacked multi-factor authentication.
How the breach unfolded
According to TechCrunch, hackers linked to China breached ConnectWise’s cloud backup service and stole application credentials. These credentials allowed them to log in to customers’ Microsoft-hosted environments as authorized users, accessing emails and other sensitive files.
The attackers used an AI framework called ARTEX to automate the breach of around 2,250 organizations. The attacks occurred at a rate of nearly 3,000 attempted sign-ins per minute, giving defenders little time to respond.
ARTEX and broader cybersecurity risks
The ARTEX framework, an open-source AI agent used in the attack, was also implicated in a recent compromise of South Korea’s financial systems. Researchers noted that weak security measures, including the absence of multi-factor authentication, contributed to the success of that attack.
Microsoft’s findings highlight the growing use of AI in cyberattacks, enabling threat actors to scale operations and evade traditional defenses. The speed and volume of the ConnectWise breach demonstrate the urgency for organizations to adopt adaptive security measures.
ConnectWise’s response
ConnectWise has paused access to its cloud backup system while investigating the breach. The company is working to restore the service, though no timeline has been provided.
The incident raises questions about the security practices of IT management platforms, which often hold privileged access to thousands of customer systems.
This breach follows a pattern of state-sponsored actors targeting critical infrastructure providers, amplifying the potential impact of a single compromise.
Relevant background
The breach aligns with Microsoft’s recent focus on AI-driven security tools for enterprises, as reported in Lazyfounder’s earlier coverage. The company’s Guardian Agents and dynamic security controls were introduced to counter emerging threats, including those posed by AI-powered attacks.
While Microsoft’s initiatives aim to mitigate risks, this incident underscores the challenges of defending against state-aligned hackers using advanced techniques.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
For founders and operators, this breach is a stark reminder of the vulnerabilities inherent in third-party IT management tools. ConnectWise’s role as a central hub for remote access made it a high-value target, but the real damage was done through its customers—thousands of organizations now face potential exposure. The use of AI to accelerate attacks adds a new layer of complexity, requiring companies to rethink their security strategies beyond traditional perimeter defenses.
The incident also highlights the broader risk of state-sponsored cyber threats, which are increasingly sophisticated and relentless. Founders should assume that any critical infrastructure provider—whether a cloud platform, IT management tool, or financial system—could become a target. The absence of multi-factor authentication in the South Korea financial breach is a cautionary tale: basic security gaps can have cascading consequences.
Finally, the role of AI in this attack signals a shift in cyber warfare. Defenders must now contend with threats that can adapt, learn, and scale faster than human-driven responses. Companies that rely on static security measures or assume their vendors are invulnerable are at heightened risk.
Key takeaways
- Founders and operators using ConnectWise or similar remote access tools must audit their credential security and enable multi-factor authentication immediately.
- The use of AI-driven attack frameworks like ARTEX demonstrates the escalating sophistication of state-sponsored cyber threats, requiring proactive defense strategies.
- This breach underscores the risks of third-party IT management platforms, which can become single points of failure for thousands of downstream customers.
Related on Lazyfounder
Sources
- TechCrunch · 2026-10-22
Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
