ConnectWise was reported on 26 October to be targeting today to begin restoring its Cloud Backup service, nine days after it shut the service down. That timing is conditional, not a guarantee of normal service, and it comes with a clear condition from the reporting: each Microsoft 365 tenant still needs its own review before anyone reconnects.

Why the shutdown happened

The service, formerly SkyKick, is used mainly by managed service providers to back up client email, files and Teams data. ConnectWise suspended Cloud Backup after attackers used its application identities to reach customer Microsoft 365 tenants. Because a trusted vendor application can sign in without an interactive user login or multi-factor prompt, one compromised credential could be tried across many tenants where the app had been consented.

What is confirmed, and what is not

Huntress confirmed unauthorised sign-ins in 162 Microsoft 365 tenants and later found activity from the attacker's address in far more tenants. Microsoft's reporting describes sign-in attempts against more than 2,250 tenants. Attempted sign-ins and confirmed compromise are not the same thing, and ConnectWise has said it cannot see into individual customer tenants. ConnectWise has also said it found no evidence that stored backups themselves were accessed, and that archives remain encrypted and isolated. That does not remove the need to check live tenant activity.

What tenants should do first

Keep the affected ConnectWise/SkyKick applications disabled until ConnectWise gives service-specific reconnection instructions. Review service-principal sign-in logs, Microsoft Graph activity, role changes and newly added credentials since 13 October, and treat any unfamiliar change as a persistence risk to investigate before restoring backups. Restoration is not a switch-on moment — it is a per-tenant check, and a tenant reconnected without one may simply reopen the door the attackers used.

Source: CyberExperts