A China state-aligned hacking group broke into ConnectWise, a major provider of IT management software, and used stolen credentials to spy on thousands of organisations, Microsoft said, in an attack that highlights how artificial intelligence is accelerating cyber espionage.
The hackers broke into ConnectWise's cloud backup service and stole application credentials that customers use to connect ConnectWise with their own systems, TechCrunch reported on Thursday, October 22, citing research published by Microsoft. With those credentials, the attackers could log in to customers' Microsoft-hosted environments as authorised users and access email and files.
Microsoft said the hackers targeted about 2,250 organisations, attempting sign-ins at a rate of almost 3,000 per minute. Microsoft tracks the group as Storm-0940, according to its blog post.
AI at machine speed
The most striking aspect of the attack was its speed. Microsoft credited the use of AI agents, specifically an open-source framework called ARTEX, which pairs with AI models to stress-test cyber defences. The same software was used in a recent compromise of South Korean financial systems that had weak security and lacked multi-factor authentication, TechCrunch reported.
Microsoft warned that the pace of such attacks gives defenders "little time to detect and respond."
Security experts have long warned that AI would allow attackers to automate tasks that previously required significant human effort, from scanning for vulnerabilities to crafting phishing messages and moving through compromised networks. The ConnectWise attack appears to be one of the clearest examples of AI agents being used to scale a nation-state operation.
ConnectWise's response
ConnectWise paused access to its cloud backup system while it investigated the breach and was working to restore the service as of Thursday, according to TechCrunch.
ConnectWise's software is widely used by managed service providers, companies that run IT systems for other businesses. That makes it a high-value target: compromising one provider can give attackers access to many downstream customers. ConnectWise has faced previous security incidents, including a nation-state attack disclosed in 2025 that targeted customers of its ScreenConnect remote access software.
The supply chain problem
The attack is the latest example of a software supply chain compromise, in which attackers target a widely used vendor to reach its customers. Notable earlier examples include the SolarWinds breach discovered in 2020, attributed to Russian intelligence, and attacks on Kaseya, another IT management software provider, in 2021.
Supply chain attacks are particularly dangerous because customers trust their vendors' software and credentials. Stolen application credentials can let attackers bypass traditional defences, since their activity may look like legitimate access by an authorised service.
The incident came during a turbulent week for cybersecurity. Researchers this week disclosed critical vulnerabilities in the PHP programming language that underpins much of the web, and developer platform Railway urged all users to revoke secret keys after a cyberattack.
China's cyber operations
Chinese state-linked hacking groups have been accused of extensive espionage campaigns targeting governments, telecom companies, technology firms and critical infrastructure in the United States and elsewhere. US agencies have warned about groups that have infiltrated telecom networks and positioned themselves inside critical infrastructure.
China has consistently denied involvement in hacking and accuses the United States of conducting its own cyber operations.
The use of AI by state-backed hackers adds a new dimension to these concerns. Western governments and technology companies have reported that hackers linked to several countries have experimented with AI models to support their operations, and AI developers have taken steps to detect and block misuse of their tools.
What it means for businesses
For organisations, the attack underscores several lessons. Credentials used to connect third-party services should be closely monitored, limited in scope and rotated regularly. Unusual sign-in activity, particularly at high volumes, should trigger alerts. Multi-factor authentication and conditional access policies can reduce the risk of stolen credentials being misused.
A Microsoft vice-president said this week that AI agents must be given limited access to networks, as attacks become more automated, a principle that applies equally to defensive and business use of AI.
What it means for India
Indian companies, particularly IT services firms and those relying on managed service providers, face similar risks. India has experienced a rising number of cyber incidents, including attacks on financial institutions and government systems. The Indian Computer Emergency Response Team has repeatedly urged organisations to strengthen defences against supply chain attacks.
India's IT services industry, which manages systems for clients worldwide, is itself part of global technology supply chains. Ensuring the security of tools and credentials used to manage client environments is critical to maintaining trust.
The scale of the threat
Cyberattacks have grown in frequency and sophistication, with state-backed groups, criminal gangs and hacktivists all active. Ransomware attacks have disrupted hospitals, manufacturers and governments, while espionage campaigns have targeted sensitive data and intellectual property.
The use of AI by attackers is likely to increase the volume and speed of attacks, making automated defences essential. Security companies are developing AI tools that can detect anomalies, investigate alerts and respond to threats faster than human analysts. The contest between offensive and defensive AI is becoming a defining feature of cybersecurity.
The cost of breaches
Data breaches carry significant costs for organisations, including investigation, remediation, legal liability, regulatory fines and reputational damage. Supply chain breaches can be especially expensive, since affected organisations may have little visibility into how their vendors' systems were compromised.
Regulators are increasingly requiring companies to disclose significant cyber incidents promptly and to manage third-party risks. In the United States, listed companies must report material cybersecurity incidents, and similar requirements are expanding globally.
What comes next
ConnectWise's investigation will seek to determine how the attackers gained access to its cloud backup service and how many customers were affected. Microsoft and other security firms are likely to publish further guidance.
For the cybersecurity industry, the attack is a warning that AI is changing the speed and scale of threats. Defenders will increasingly need AI-powered tools of their own to keep pace. For governments, the attack reinforces calls for stronger standards for software vendors and better information sharing between companies and agencies. In India, which is expanding its digital economy rapidly, such measures are increasingly seen as essential to protecting businesses and public services from sophisticated threats. Organisations that review vendor access now will be better prepared for the next such attack.
