ConnectWise Updates Cloud Backup Restoration After ARTEX Attack

TL;DR - Since the last update, ConnectWise has set a target of beginning phased partner onboarding on October 26, subject to restoration testing and security validation. - ConnectWise expects to enable access for restoring data from existing backups first, followed by phased full-service re-enrollment. - Microsoft attributes the ConnectWise supply chain compromise to China-state aligned actor Storm-0940, which used ARTEX to accelerate scanning, password spraying and OAuth application abuse. - Partners should keep affected application connections disabled until ConnectWise provides instructions that apply to their service, and review connected Microsoft 365 environments.

What happened#

ConnectWise says it identified unauthorized access to application credentials associated with Cloud Backup, formerly known as SkyKick. The company says its teams and independent specialists are restoring services in a controlled sequence and rotating certificates across its infrastructure.

In its October 24 update, ConnectWise said restoration, testing and security validation would continue through the weekend, with a target of beginning phased partner onboarding on Monday, October 26, subject to successful completion of required checks. The company expects to enable a process for partners to restore data from existing backups first. Full service re-enrollment will follow in phases, supported by step-by-step instructions, video tutorials and webinars. ConnectWise cautions that bringing infrastructure online does not mean all partner capabilities are available. ConnectWise’s advisory says partners should wait for instructions that apply to their service.

ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise. It also says it has no indication that other ConnectWise products, services or offerings are affected by this incident.

Microsoft assesses that Storm-0940, a China-state aligned actor, was responsible for the ConnectWise supply chain compromise. Microsoft says the actor used ARTEX, an agentic AI penetration testing framework, to accelerate scanning and reconnaissance, password spraying and OAuth application abuse against downstream victims. The actor used applications that had already been granted access to authenticate to Microsoft 365 customer environments without an interactive user sign-in.

Microsoft observed follow-on activity through Microsoft Graph, including reconnaissance, application credential changes and attempts to modify privileges. These actions could enable expanded or persistent access. Microsoft says the activity did not result from a compromise of, or vulnerability in, Microsoft corporate systems, products or services. Microsoft’s account says Storm-0940 used ARTEX to target hundreds of organizations globally across multiple industries.

Microsoft also reports that some ARTEX-driven attacks obtained privileged access to cloud infrastructure in less than 3 hours from initial targeting. It says the actor attempted to sign in to more than 2,250 tenants. In a separate password-spraying campaign between October 10 and 14, 2026, Microsoft observed 151,000+ failed logon events targeting 327 accounts across eight organizations. Microsoft says no successful authentication, token issuance, Graph call or directory change was detected in that password-spraying activity. On October 15, 2026, the actor began using stolen application credentials associated with multiple ConnectWise cloud applications to authenticate to customer environments.

Are you affected#

The directly identified ConnectWise service is Cloud Backup, formerly SkyKick. Partners should keep affected application connections disabled until ConnectWise provides service-specific instructions. The company says the restoration process will begin with backup restoration access, followed by phased full-service re-enrollment.

Organizations that use Cloud Backup, or manage Microsoft 365 environments connected to it, should separately review their own tenant and each managed customer tenant. The review should include legacy SkyKick integrations, service principal sign-ins, application registrations, application credentials and permissions.

Microsoft says the presence of an affected application, or successful threat actor authentication, does not necessarily indicate that customer data was accessed or exfiltrated. It recommends reviewing service principal sign-ins and investigating unexpected application credential or privilege changes.

ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise. That statement does not establish whether an individual partner or customer Microsoft 365 tenant was affected.

ConnectWise also published separate updates concerning Axcient services and two critical PHP vulnerabilities. It says the Axcient portal issue was separate from the Cloud Backup incident. No CVE identifier, fixed PHP version or exploitation status for those PHP vulnerabilities is provided in the cited ConnectWise material.

What is confirmed and what is reported#

What defenders should do now#

1. Keep affected Cloud Backup application connections disabled until ConnectWise provides instructions that apply to the service. Do not treat infrastructure restoration or the October 26 onboarding target as permission to reconnect.

2. Follow ConnectWise’s Trust Center updates for the backup restoration process, phased re-enrollment instructions, video tutorials and webinars.

3. Review the organization’s Microsoft 365 tenant and every managed customer tenant connected to Cloud Backup. Include legacy SkyKick integrations.

4. Examine Microsoft Entra ID sign-in and audit logs, service principal sign-ins, application registrations, application credentials and permissions. Look for unexpected authentication, credential changes or privilege changes.

5. Investigate identities, groups and privileged roles for unauthorized modifications. Microsoft says application credential changes can create persistence through other identities, credentials and cloud services.

6. Preserve relevant sign-in, audit, application and directory evidence for investigation. Microsoft says Defender XDR provides detections and hunting queries for suspicious Microsoft Graph activity and activity associated with known threat infrastructure.

7. Continue using ConnectWise’s technical investigation and remediation guide and technical webinars for both the partner tenant and managed customer environments.

8. Report suspicious activity to ConnectWise at SecurityPartnerSupport@ConnectWise.com and monitor the ConnectWise Trust Center for confirmed availability and reconnection instructions.

This advisory is informational and is updated as vendors publish details. Confirm versions and actions against the vendor’s own guidance for your environment.

Sources

• Primary notice: connectwise.com
• Research: microsoft.com
• Research: recordedfuture.com
• Report: thehackernews.com