China-Linked Hackers Used Stolen ConnectWise Credentials to Reach Thousands of Organizations
Microsoft researchers say China state-aligned hackers broke into ConnectWise's cloud backup service and stole the application credentials ConnectWise uses to establish data links with its corporate customers. The findings appear in a Microsoft Security blog post dated October 21, 2026, which attributes the intrusion to an actor the company tracks as Storm-0940.
Application credentials are secret keys, or tokens, that let one piece of software authenticate to another without a human logging in. With those credentials, the attackers could sign in to customers' Microsoft-hosted environments as an authorized user, and from there reach email and other files. Microsoft said Storm-0940 used ARTEX agentic AI, a class of AI that plans and executes multi-step tasks with limited human direction, to accelerate the ConnectWise supply chain compromise, enabling application credential abuse across Microsoft 365 environments.
Microsoft also emphasized scale. The company said the hackers used AI agents to break into around 2,250 organizations, at a rate of almost 3,000 attempted sign-ins per minute. Microsoft said the speed of the mass intrusions gave defenders little time to detect and respond. TechCrunch's report, published October 22, carries the same figures.
ARTEX is an open-source AI framework that works with AI models to stress-test cyber defenses, meaning it runs simulated attacks to find weaknesses before real attackers do. According to TechCrunch, the same ARTEX software was used in a recent compromise of South Korea's financial systems. Separately, Reuters reported on October 21 that a Chinese-linked hacking group used an AI-driven penetration testing tool to compromise ConnectWise. Reuters did not, in the material available to me, tie that tool to ARTEX by name, so the two descriptions should be read as separate reports until a further attribution is published.
ConnectWise has paused access to its cloud backup system and is investigating the breach. As of October 22, 2026, the company said it was working on restoring the service. Its Trust Center listed an advisory on October 21 titled "Axcient security and portal availability update."
In my view, the mechanics matter more than the headline count. A breach of a service provider's stored credentials turns one compromise into a route into every customer tenant that trusted them. Because the attacker authenticates as a legitimate application identity, its sign-ins can resemble ordinary service traffic. Detection therefore depends on app-level sign-in logs, token activity and credential lifecycle records, not only on conventional user-account alerts. For any organization that exchanged data with ConnectWise, rotating and scoping those application credentials, and reviewing what they could read, is the practical first step.
The broader context here is that the tooling letting an attacker automate reconnaissance and authentication at this pace also lets defenders run the same kind of adversarial testing against their own perimeters. Stress-testing frameworks were built for that purpose. How much this episode shifts the balance depends on how quickly defensive teams adopt equivalent automation, and on whether identity monitoring can keep pace with sign-in rates measured in thousands per minute. The next disclosures from Microsoft, ConnectWise and the investigators will narrow those questions.
