The breach of ConnectWise, a US technology provider whose software connects businesses to their cloud services, illustrates a growing problem within the cyber security ecosystem. Disclosed in October 2026, the incident involved a China state-aligned hacking group that allegedly exploited trusted software connections to reach organisations far beyond the original target. Microsoft identified the group as Storm-0940 and said it used an AI-enabled penetration-testing framework to automate parts of its campaign. The targeting extended across defence, energy, finance, government and technology. In several cases, attackers gained privileged access to cloud environments, raising concerns that access could persist even after the initial breach was contained. Beijing ofcourse denied responsibility.
ConnectWise was not simply a company holding sensitive information of its own. Its software had trusted connections to other organisations, making it a potential route into their systems. Once that trust was compromised, the attackers could attempt to reach multiple customers without breaking into each organisation independently.
This is a recurring feature of Chinese state-linked cyber operations. Their targets range from government communications and political dissidents to critical infrastructure and private companies. The methods differ, but the pattern is increasingly clear. Rather than pursuing only individual high-value targets, these operations exploit the systems, suppliers and relationships on which many organisations depend.
One breach can open thousands of doors
The ConnectWise incident is a particularly clear example of the risks created by interconnected technology. According to Microsoft’s investigation, Storm-0940 used an open-source framework called ARTEX to automate reconnaissance, password attacks and the misuse of existing application permissions. Microsoft recorded attempts to reach more than 2,250 customer tenants, at a rate of approximately 2,900 sign-in attempts per minute. While most attempts were unsuccessful, some organisations experienced activity that could establish persistent access to their cloud systems. Microsoft cautioned that successful authentication did not necessarily mean data had been accessed or stolen.
The use of AI is noteworthy, but it is not the central story. The framework did not invent a new form of espionage but rather accelerated familiar activities, including scanning networks, testing credentials and exploiting permissions. The advantage came from speed and scale. When thousands of attempts can be made in parallel, security teams have less time to identify unusual activity and restrict access.
The deeper vulnerability was the trust placed in a third-party application. Businesses routinely grant software providers access to email, cloud storage, customer records and administrative systems because these connections are necessary for daily operations. A compromised provider can therefore create risks for customers who have done nothing to invite an intrusion themselves. China-linked cyber operations have repeatedly exploited similar weaknesses. In 2024, the campaign known as Salt Typhoon compromised telecommunications networks, including major US providers. US authorities said the attackers obtained call records, some private communications and information associated with a limited number of individuals involved in government or political activity. The campaign also extended beyond the United States, prompting warnings about the security of global telecommunications infrastructure.
Telecommunications networks are particularly valuable because they carry enormous amounts of information about how people communicate. Even without intercepting every conversation, access to call records and related data can reveal who is communicating with whom, when they are in contact and where particular devices are located. Such information can help identify government officials, intelligence targets and their networks of contacts.
Salt Typhoon and ConnectWise demonstrate different sides of the same problem. One targeted the infrastructure through which communications travel. The other exploited trusted software connections to reach customer environments. In both cases, the potential value extended beyond the organisation initially compromised.
The infrastructure that makes cyber espionage possible
The wider ecosystem supporting Chinese cyber operations is as important as the individual breaches. In March 2025, the US Justice Department charged 10 Chinese nationals in connection with hacking activities conducted through i-Soon, a China-based cybersecurity company. According to the indictment, the company worked with Chinese public security and state security agencies to compromise email accounts, mobile phones, servers and websites between 2016 and 2023. Its targets included government agencies, foreign ministries, news organisations, religious groups and critics of the Chinese Communist Party. Investigators said i-Soon worked with at least 43 government security bureaus and charged agencies between USD 10,000 and USD 75,000 for each successfully compromised email inbox. These remain allegations in criminal proceedings, but the documents offer a detailed account of how private contractors can support state-directed cyber operations.
The model complicates the distinction between government operations and private cybercrime. Contractors can supply technical expertise, develop tools and carry out intrusions, while the use of commercial entities can make it harder to establish direct state involvement. The i-Soon case also suggests that stolen information can serve several purposes, from intelligence gathering to monitoring political opponents overseas.
Another example is Volt Typhoon, a group that US authorities have attributed to China. Beginning with disclosures in 2023, American agencies described intrusions into critical infrastructure networks, including communications, energy, transportation and water systems. Unlike campaigns primarily aimed at stealing information, Volt Typhoon appeared to be positioning itself within networks in ways that could enable disruption during a future crisis. Investigators reported that the operators often used legitimate system tools and stolen credentials to blend into normal activity rather than relying on conspicuous malware.
The reach of these operations also extends beyond US infrastructure. In September 2024, the US Justice Department disrupted a botnet of more than 200,000 internet-connected devices, including routers and network cameras, that it attributed to China state-sponsored hackers associated with Flax Typhoon. The compromised devices could be used to obscure the origin of malicious activity and provide infrastructure for further operations.
The extent of such cases reveals an ecosystem that combines state priorities, commercial expertise and access to vulnerable digital infrastructure. Not every Chinese cybersecurity company or researcher participates in espionage, and attribution remains difficult in many incidents. But the documented cases show how private capabilities can be used to extend the reach of state-linked operations.
The cost of treating every breach as an isolated incident
The recurring weakness in these cases is that organisations often discover a compromise only after attackers have gained access through a system, they considered trustworthy. A software provider, a telecommunications network or an ordinary internet-connected device can become the entry point for a much larger operation.
That creates a problem for governments and businesses alike. Strengthening the security of an individual organisation is not enough if its suppliers, service providers or network connections remain vulnerable. Nor is removing the initial intruder always sufficient. Attackers who have obtained administrative permissions or created additional credentials may retain access after the original compromise has been addressed.
The ConnectWise incident also shows how emerging technology can change the economics of espionage. AI-assisted automation can reduce the time and effort needed to identify targets and exploit weaknesses. It does not eliminate the need for technical expertise, but it allows a capable operator to attempt more intrusions in less time. The result is a larger number of potential victims and a narrower window for defenders to respond.
China is not the only state accused of using cyber operations for intelligence collection or strategic advantage. The United States, Russia, Iran and other governments also conduct cyber operations. The relevant distinction is not nationality alone, but the documented use of unauthorised access to obtain information, monitor political targets or position capabilities inside critical systems.
For Beijing, however, the accumulated record of cases attributed to Chinese state-linked actors raises questions about how far its intelligence and security apparatus relies on a dispersed network of contractors and technical intermediaries. The combination of commercial access, large-scale targeting and persistent intrusions makes it difficult to contain the damage within the organisation first breached.
The ConnectWise attack is therefore more than another entry in the long list of cyber incidents. It exemplifies how a compromise at one company can expose a much wider network of institutions, businesses and services. The central risk in all this remains that such malicious actors can establish access to systems on which others depend, sometimes without those organisations immediately realising it.