Tampa-based technology company ConnectWise is beginning to restore cloud services nearly two weeks after a suspected China-linked cyberattack forced the company to shut down three systems, interrupting customer backups, security monitoring and account management functions.
The company says hackers used artificial intelligence to accelerate the attack, although investigators have yet to determine whether they accessed individual customer accounts.
The breach, discovered Oct. 14, involved unauthorized access to application credentials associated with ConnectWise Cloud Backup, formerly known as SkyKick, which businesses use to protect and recover information stored in Microsoft 365.
By Oct. 17, the company had disabled seven application identities and suspended Cloud Backup, SaaS Security and Cloud Management, leaving affected customers unable to run scheduled backups, restore stored information or use certain security and management tools.
ConnectWise traced the attack to a suspected Chinese state-aligned hacking group in an Oct. 21 advisory, citing its own investigation and threat intelligence shared by Microsoft. According to the company, the hackers used a publicly available AI framework to automate their operation, part of a broader campaign targeting industries ranging from defense and financial services to government and manufacturing.
Microsoft’s research also found that attackers using the same framework had gained privileged access to some cloud environments in fewer than three hours, although ConnectWise has not established how quickly its own systems were breached.
The compromised credentials belonged to applications that connect with Microsoft 365, giving the attackers a potential route into customer environments managed through ConnectWise’s software. That possibility is particularly concerning for managed service providers, which use the company’s technology to oversee multiple business customers and may hold administrative permissions across their accounts.
Investigators have not established how the credentials were exposed, whether a software vulnerability contributed to the breach or whether the hackers used those connections to gain additional access.
Disabling the affected applications prevented further authentication through those connections, although it could not undo changes the attackers may have made before ConnectWise shut them down.
The company has directed its partners to review their own Microsoft 365 environments and those of their customers for suspicious logins, unauthorized administrator permissions, altered email forwarding rules and other changes that could allow an attacker to retain access.
Those inspections include reviewing authentication records dating to Oct. 13 and checking three suspicious internet protocol addresses identified during the investigation, with ConnectWise cautioning that the indicators alone do not prove a customer was compromised.
The company says its stored backup archives remain encrypted and isolated, with no evidence that they were accessed, and it has not identified confirmed intrusions into customer networks or devices. Its investigation cannot independently rule out unauthorized activity within individual Microsoft 365 accounts.
ConnectWise completed a reset of accounts and credentials in its affected Cloud Backup environment Oct. 19, then worked with outside forensic specialists to validate its systems before allowing customers to reconnect.
The company reported no successful threat activity in the environments it monitored after implementing containment measures Oct. 17, and on Wednesday, Oct. 28, announced that it was beginning to restore Microsoft 365 backup and recovery functions through a new application with strengthened security protections.
The restoration requires customers to reset their passwords, complete multifactor authentication and reauthorize each Microsoft 365 account through the replacement application before backups and recovery operations can resume.
Customer portal access, backup monitoring, reporting, exports and notifications will return in later phases, while administrators must verify that new backups have been completed rather than assuming that reconnecting an account automatically restores protection.
For businesses relying on the service, the interruption will leave a gap between their last successful backup before the shutdown and the first completed backup after recovery, which administrators will need to identify and account for.
ConnectWise has also instructed customers to leave previously disabled applications disconnected unless specifically authorized to restore them, even as the company brings other functions back online.
The attack follows another suspected nation-state intrusion disclosed by ConnectWise in May 2025, when suspicious activity involving its ScreenConnect remote-access software affected a small number of customers and prompted an investigation involving cybersecurity firm Mandiant.
No connection between the incidents has been established, and ConnectWise has not disclosed how many customers were affected by the latest shutdown or determined the full extent of the hackers’ access.