ConnectWise customers face 2,250 AI-aided intrusions, Microsoft says

Microsoft researchers said in an Oct. 21 security blog that China state-aligned hackers used stolen ConnectWise application credentials to reach about 2,250 organizations through an AI-aided sign-in campaign.

At nearly 3,000 attempted sign-ins a minute, the login pace exceeded the entire reported pool of targeted organizations every minute, a speed Microsoft said gave defenders “little time to detect and respond.”

ConnectWise, an IT management and remote-access provider, said in an Oct. 22 advisory that it had paused access to its cloud backup system while it investigated the breach. The company said Thursday it was working to restore the service.

Microsoft said the stolen credentials were used to create data links between ConnectWise and corporate customers that rely on the backup service. The attackers could then enter customer Microsoft-hosted environments with the appearance of legitimate access and view emails and other files, according to Microsoft.

Microsoft attributed the speed of the activity to AI agents, software systems that can automate tasks through models and tools. The company identified ARTEX, an open-source framework used with AI models to test cyber defenses, as the technology used in the campaign.

The reported breach follows an Atlas360 report on Oct. 20 that ConnectWise had suspended multiple cloud services after a supply-chain attack allowed unauthorized access to customer Microsoft 365 environments through compromised application credentials.

Source: TechCrunch article, Oct. 22, 2026; Microsoft security blog, Oct. 21, 2026; ConnectWise advisory, Oct. 22, 2026