Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise
- ID
- 38348
- Status
- summarized
- Published
- 23 Oct 2026, 12:47 AM
- Fetched
- 23 Oct 2026, 1:21 AM
- Provider
- TechCrunch
- Category
- technology
- Original URL
- https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/
- Source URL
- https://techcrunch.com/feed/
Summary
- Score
- 7.5
- Created
- 23 Oct 2026, 1:21 AM
- Tags
- Audience
- developersai_agent_userssaas_founders
What happened
Microsoft says China state-aligned hackers breached ConnectWise's cloud backup service, stole application credentials used for customer data links, and accessed Microsoft-hosted email and files at around 2,250 organizations. The attackers used AI agents, including the open-source ARTEX framework, to attempt nearly 3,000 sign-ins per minute, and the same tooling was used in a recent compromise of South Korea's financial systems. ConnectWise has paused access to its cloud backup system and says it is investigating and restoring the service.
Why it matters
If your team relies on ConnectWise Cloud Backup or similar MSP/backup integrations, treat linked app credentials as exposed: rotate or revoke them, enforce MFA and conditional access, and review sign-in logs for abnormal volume. For anyone building or deploying AI agents, this is a concrete case of agent-driven authentication abuse at roughly 3,000 attempts per minute, so rate limits, anomaly detection, and credential scoping are not optional.
Discussion angle
What specific controls would catch or block 3,000 sign-in attempts per minute through trusted app credentials, and should backup/MSP integrations be treated as high-risk trust links?