ConnectWise says access to Cloud Backup restoration remains conditional on security validation. In its October 23 update, the company says testing and validation are underway, with completion expected by the end of the weekend and backup-restoration access anticipated early the following week if validation succeeds.
What ConnectWise said about restoration
ConnectWise says existing backup archives remain encrypted, isolated and preserved, with no indication of compromise. That statement concerns stored archives. It is separate from activity Microsoft observed in some customer Microsoft 365 environments.
ConnectWise identifies Cloud Backup, formerly SkyKick, as the affected service. It also suspended SaaS Security and Cloud Management because they were integrated with Cloud Backup, and said it had no indication that other offerings were impacted. The company said it disabled seven application identities and suspended Cloud Backup access on October 17, then completed a reset of accounts and credentials in the affected environment on October 19.
What Wiz observed at other software vendors
Wiz reports ARTEX-associated attempts to probe software vendors’ applications and identity systems, including Okta, Microsoft Entra ID and AWS Cognito. The activity it observed included discovering API routes and application source maps, probing OAuth callbacks and unsigned JSON Web Tokens (JWTs), registering with temporary email addresses, testing account-recovery paths and probing tenant isolation.
Wiz said most of the attempts it observed failed. Some sessions lasted 24 to 30 hours, and when IP addresses were blocked, new addresses appeared within minutes, the company reported.
Microsoft separates two phases of activity
Microsoft’s October 21 assessment attributes the ConnectWise compromise to Storm-0940, which it describes as a China-state-aligned actor. Microsoft says the actor used ARTEX, an autonomous AI penetration-testing framework, to accelerate scanning, reconnaissance, password spraying and OAuth application abuse.
Microsoft says a password-spray campaign from October 10 through 14 targeted 327 accounts across eight organizations and generated more than 151,000 failed logon events. In that phase, Microsoft observed no successful authentication, token issuance, Microsoft Graph call or directory change. Separately, Microsoft says actors began using identities of multiple ConnectWise cloud applications to authenticate to customer environments on October 15. In some environments, it observed reconnaissance and changes involving application credentials, identities, groups and privileged roles.
NeoTeo previously covered the Microsoft 365 sign-in activity and what those figures mean. Microsoft says the presence of an affected application or a successful authentication alone does not establish that customer data was accessed or exfiltrated.
