China-Linked Groups Use AI to Accelerate Cyber Attacks
The shift toward AI-enabled supply chain compromises allows state-aligned hackers to infiltrate multiple networks simultaneously.
Updated on Oct. 31, 2026 in Cybersecurity
Live Poll
Should companies be legally liable for security breaches occurring within their trusted third-party software supply chains?
China-aligned hacking groups are now using AI to automate credential attacks, significantly increasing the speed and scale of cyber operations. In 2026, a state-aligned group compromised the software provider ConnectWise to gain access to multiple downstream organizations.
Why it matters
By targeting service providers rather than individual systems, attackers bypass traditional perimeter defenses to infiltrate sensitive sectors like government and energy. This shift leverages automation to turn trusted supply chain connections into broad vectors for institutional espionage.
Attackers are utilizing automated penetration-testing software that maps network vulnerabilities at speeds exceeding human-led reconnaissance. These tools enable mass-scale credential harvesting, allowing breaches to propagate through trusted supply chain links rather than requiring individual exploitation of every target.
The players
ConnectWise
A provider of remote monitoring and management software that facilitates IT service delivery for various managed service providers.
i-Soon
A private contractor that functioned as an intelligence-gathering arm for Chinese state security agencies between 2016 and 2023.
The details
The strategy relies on software-supply-chain compromise, where attackers infiltrate a service provider to reach multiple downstream clients simultaneously. By integrating AI into these frameworks, hackers automate the identification of weak credentials and network entry points. This approach minimizes the need for independent breaches, as the compromised software acts as an authenticated bridge into the internal networks of the primary victims.
Timeline
From 2016 to 2023, i-Soon collaborated with Chinese public security and state security agencies.
In March 2025, the US Justice Department charged 10 Chinese nationals for hacking activities.
In 2026, a China state-aligned group breached ConnectWise.
The Tech Race
The transition to AI-enabled offensive cyber operations represents a significant departure from manual, resource-intensive hacking campaigns. This shift mirrors the aggressive tactical evolution seen during the Salt Typhoon campaign, where attackers prioritized high-level access through critical infrastructure nodes.
Organizations relying on managed service providers and third-party software vendors face increased risk of indirect compromise. IT administrators should prioritize auditing vendor access logs and implementing granular zero-trust authentication to defend against automated lateral movement.
The takeaway
The move toward AI-driven supply chain attacks demonstrates that defenders must now secure the integrity of their vendor software as rigorously as their own internal systems. Security teams should monitor future US Justice Department filings regarding the 10 nationals charged in 2025 for further intelligence on these tactics.
Further reading
For broader trends in digital threat intelligence, visit the Cybersecurity archive.
Source note: This article includes information reported by Bizzbuzz.
Live Poll
Should companies be legally liable for security breaches occurring within their trusted third-party software supply chains?
