Chinese Hackers Hit ConnectWise in Major Cyber Espionage
State-linked Chinese hackers breached ConnectWise cloud backup systems using automated software agents, stealing application tokens to penetrate roughly 2,250 corporate customer networks across Microsoft environments at rapid speeds of nearly 3,000 login attempts per minute.
Umar Abubakar | · 9 min read
Managed information technology service providers hold the digital master keys to corporate commerce. Small accounting firms, regional hospitals, manufacturing plants, and municipal offices rarely employ internal cybersecurity departments. Instead, they hire external managed service providers to configure firewalls, install operating system patches, and manage off-site data backups. To perform those duties, service providers install administrative agents that possess unrestricted access across client computer networks. When an intruder compromises that central management hub, the breach cascades downward into thousands of customer accounts simultaneously. That nightmare scenario materialized on Thursday, October 22, 2026. Security researchers at Microsoft confirmed that a state-aligned Chinese hacking syndicate, tracked under the codename Storm-0940, broke into cloud backup systems operated by IT management giant ConnectWise. The attackers stole application authentication credentials, weaponizing those credentials through automated software tools to penetrate approximately 2,250 corporate customer networks hosted on Microsoft infrastructure. The incident represents an aggressive escalation in digital espionage, matching cyber threat patterns we documented when machine tools lowered barriers for digital intrusions.
The scale and execution speed of the intrusion caught corporate defense teams flat-footed. ConnectWise, based in Tampa, Florida, serves more than 40,000 corporate clients globally, providing software that monitors server health, deploys software updates, and backs up critical databases. According to forensic investigation disclosures published by TechCrunch, the intruders stole OAuth tokens and application secret keys used to link ConnectWise cloud backup services with customer Microsoft 365 and Azure tenancies. Armed with these authorized credentials, the attackers bypassed multi-factor authentication defenses, signing into customer environments as trusted system applications. The hackers used an open-source autonomous testing framework called ARTEX to execute authentication queries at blistering speeds, attempting nearly 3,000 individual logins every sixty seconds. ConnectWise paused access to its cloud backup system to contain the damage while engineering teams work to revoke compromised tokens and restore safe operations. The incident arrives as federal agencies move to defend critical infrastructure, an effort visible when the United States banned Chinese software models from federal networks.
The Physics of Token Theft and Cloud Supply Chain Vulnerability
To grasp how the attackers achieved such deep access, one must inspect modern cloud authentication plumbing. In traditional on-premises computing, accessing a company files required stealing a physical password and connecting to an internal network switch. Modern cloud platforms operate on application programming interface permissions governed by tokens.
When an enterprise connects ConnectWise cloud backup to its Microsoft environment, administrators grant the software application permissions to read inboxes, copy SharePoint documents, and archive SQL databases. These permissions are represented by cryptographic tokens. By infiltrating ConnectWise internal servers, Storm-0940 did not have to break into 2,250 separate corporate firewalls; they simply copied the master application tokens stored in ConnectWise database vaults. When the hackers presented those stolen tokens to Microsoft authentication servers, the computers recognized the tokens as legitimate ConnectWise backup operations. The attackers gained immediate, privileged access to internal company communications, unredacted customer databases, and proprietary engineering blueprints without triggering standard intrusion detection alarms. The operational danger of supply chain breaches was examined in our report detailing Air securing seed capital to protect enterprise supply networks.
The Debut of Machine-Speed Espionage: 3,000 Logins Per Minute
The defining technical revelation of the ConnectWise breach is the weaponization of automated software agents in live espionage operations. Historically, even well-funded state-sponsored intelligence units operated with significant manual oversight. Human operators in Beijing or Shanghai would log into a target network, manually type reconnaissance commands, map directories, and select files for exfiltration.
Storm-0940 abandoned manual pacing, deploying an automated testing framework called ARTEX. ARTEX, originally created as an open-source tool for cybersecurity researchers to simulate high-stress network attacks, was repurposed by the hackers to automate target exploitation. Once the application tokens were stolen, the software agents launched automated credential validation loops, firing nearly 3,000 sign-in requests per minute across thousands of distinct corporate tenancies. The agents identified target file repositories, searched for keywords related to defense contracts, maritime shipping routes, and intellectual property filings, and initiated data transfers before human security teams could open an incident ticket. Operating at machine speed allows attackers to overwhelm defensive monitoring systems, giving defenders zero time to analyze anomalous network traffic. The rapid adoption of automated attack tools reflects findings we analyzed in our review of how automated software lowers expenses for malicious cyber actors.
Comparing Major Managed IT Software Supply Chain Breaches
| Security Incident | Primary Target Vendor | Suspected Threat Actor | Compromised Organizations | Primary Attack Vector |
|---|---|---|---|---|
| ConnectWise Cloud Breach (2026) | ConnectWise Backup Hub | Storm-0940 (China-aligned) | ~2,250 corporate accounts | Stolen application tokens + automated ARTEX login loops |
| Kaseya VSA Attack (2021) | Kaseya VSA Remote Engine | REvil Ransomware Syndicate | ~1,500 downstream clients | Zero-day authentication bypass pushing ransomware |
| SolarWinds Orion Breach (2020) | SolarWinds Build Pipeline | Cozy Bear / SVR (Russia) | ~18,000 customer updates | Compromised source code update with SUNBURST backdoor |
| MOVEit Transfer Exploits (2023) | Progress Software MOVEit | CL0P Ransomware Group | Over 2,700 organizations | SQL injection flaw in web application interfaces |
| Exchange Server Hafnium (2021) | Microsoft Exchange Server | Hafnium (China-linked) | Over 30,000 US entities | ProxyLogon zero-day vulnerabilities in local servers |
The comparison matrix demonstrates that supply chain attacks on managed IT providers remain a preferred strategy for foreign espionage agencies. Rather than attacking fortified government servers directly, state-aligned actors target intermediate vendors who manage administrative connections for thousands of clients. The ConnectWise incident is notable because it weaponized stolen cloud tokens rather than distributing destructive ransomware payloads, indicating that long-term intelligence gathering was the primary goal. Corporate data breaches involving identity verification were detailed in our analysis of Revolut data exposures from forged requests.
Storm-0940 and Beijing Strategic Intelligence Goals
Microsoft threat intelligence teams have tracked Storm-0940 for several years, categorizing the group as a cyber espionage unit operating in support of Chinese state priorities. Unlike criminal extortion syndicates that lock computers and demand cryptocurrency ransoms, Storm-0940 focuses on economic intelligence, trade negotiations, and technological blueprints.
Forensic analysis indicates that the compromised organizations span sectors of direct interest to Beijing five-year economic planners: semiconductor manufacturing suppliers, aerospace engineering consultancies, renewable energy materials developers, and pharmaceutical research laboratories. By extracting internal emails and proprietary design documents, the intruders obtain competitive intelligence that can assist Chinese domestic industries and inform diplomatic negotiating positions. Furthermore, gaining persistent footholds inside thousands of corporate networks provides the attackers with staging hubs to launch future operations during times of heightened geopolitical tension. The threat of state-backed cyber intrusions was explored in our analysis of researchers testing system network defenses against model breaches.
The Defensive Nightmare for Small and Mid-Market Businesses
The most painful consequence of the ConnectWise breach will be felt by small and mid-market commercial businesses. Large multinational corporations maintain dedicated security operations centers that monitor authentication logs around the clock, allowing them to spot anomalous login speeds and revoke tokens within hours.
A regional dental supply company, an architectural firm, or a community bank employing thirty people has no dedicated security staff. They trusted their local managed service provider to handle technology safely. For these smaller businesses, discovering that their emails, employee records, and client agreements were copied by foreign hackers is devastating. Many will struggle to determine which specific files were stolen, leaving them exposed to customer lawsuits, regulatory notification fines, and reputational damage. Federal cyber authorities are urging all organizations whose IT providers use ConnectWise to audit their Microsoft Azure Active Directory sign-in logs, looking for anomalous logins originating from unfamiliar IP addresses. Defensive strategies to stop automated software intrusions were detailed in our report on Pluto Security monitoring autonomous workplace software.
ConnectWise Response and Cloud Service Suspension
In response to the confirmed intrusion, ConnectWise took the drastic step of pausing its cloud backup service globally. While suspending the platform stops the hackers from using active connections to steal additional credentials, it leaves thousands of businesses without automated data backups.
If an affected company suffers an unrelated hardware failure or ransomware attack while the backup platform is paused, the business cannot restore its files. ConnectWise confirmed that its internal engineering teams, assisted by outside digital forensics consultants, are revoking all active authentication secrets, resetting customer tenant pairings, and deploying fresh cryptographic keys. The company emphasized that its on-premises management products were not directly breached, confining the intrusion to its cloud backup connection architecture. Still, the incident inflicts severe damage on ConnectWise brand reputation, arriving as enterprise buyers demand verifiable security guarantees from software vendors. Corporate risk management across software platforms was examined in our coverage of Armadin securing capital for agent security systems.
CISA Directives and Mandatory Supply Chain Reporting
The Cybersecurity and Infrastructure Security Agency intervened in the incident, issuing an urgent advisory to commercial managed service providers across the country. CISA warned that supply chain attacks on IT management tools represent a systemic national risk that threatens economic stability.
Under revised incident reporting rules established by the Cyber Incident Reporting for Critical Infrastructure Act, commercial operators of critical infrastructure must report significant cyber incidents to federal authorities within seventy-two hours of discovery, and report ransomware payments within twenty-four hours. Federal cyber monitors are coordinating with Microsoft and ConnectWise to identify all compromised government and defense contractor tenancies, providing technical guidance to purge intruders before data is transferred overseas. The federal government is considering establishing mandatory security baselines for commercial remote-management software, requiring vendors to undergo annual third-party source code audits and implement strict behavioral anomaly monitoring. Systemic security risks in distributed software were analyzed in our report on Cloudflare deploying defensive software to protect web firewalls.
The Changing Equation of Automated Cyber Warfare
The ConnectWise breach marks a clear turning point in digital conflict. For years, cybersecurity conferences debated how machine reasoning would change warfare, with theorists imagining automated cyber weapons that hunt for software bugs independently.
Storm-0940 proved that automated cyber warfare is no longer theoretical; it is an active operational reality. By pairing stolen administrative credentials with automated testing software running at 3,000 attempts per minute, the attackers achieved a scale of compromise that human operators could never replicate. Defensive models that rely on human analysts reviewing security alerts during business hours are obsolete. When attackers operate at machine speed, corporate defenses must operate at machine speed as well: using automated firewalls that detect anomalous login patterns and revoke tokens in fractions of a second. As ConnectWise works to clean its networks and corporate victims assess their losses, the lesson for the global technology industry is undeniable: in modern cyber conflict, the perimeter is only as secure as the most trusted intermediate vendor.
Read More on TechRobust:
Umar Abubakar
LinkedInUmar Abubakar
Expertise:Editorial Leadership, Product Design (UI/UX), Digital Media Strategy, Technology Systems, Product Architecture
Award:TechRobust Visionary Leader of the Year 2025
Umar serves as Editor-In-Chief of TechRobust, combining editorial vision with senior product design expertise to shape how modern technology stories are built, packaged, and told. Overseeing all editorial verticals, he directs coverage across global and regional tech industry while applying deep design thinking to publication strategy and reader experience.