Editorial analysis · Primary sources
ConnectWise begins phased Cloud Backup restoration through a new M365 application
ConnectWise has started phased restoration. Partners must reset passwords, complete MFA and authorize each tenant through a new application; re-authorization alone does not prove backups have resumed.
Confirmed update and timeline
The downstream activity began on 15 October and ConnectWise disclosed the incident on 16 October. After external validation delayed recovery, ConnectWise announced on 28 October at 16:00 UTC that phased restoration had begun [1]. Phase 1 restores Microsoft 365 backup and restore functions through a new security-hardened application, “ConnectWise Cloud Backup for M365.” Other capabilities will return in later phases [1].
Required partner actions
Partners must reset their portal password, complete multifactor-authentication setup where necessary and authorize each Microsoft 365 tenant through the new application [1]. ConnectWise says previously disabled applications must remain disabled unless it gives specific instructions. Resellers and marketplace partners must ensure the correct administrator for each customer tenant receives the instructions [1].
Mission and recovery impact
Backup snapshots and restore jobs are the first capabilities to return. Customer access and monitoring follow in phase 2, reporting and exports in phase 3, and notifications in phase 4 [1]. The monitoring history will show the gap between the last pre-incident snapshot and the first successful new snapshot. Re-authorization does not confirm that backups have resumed; each tenant requires evidence of a completed snapshot [1].
Security validation priorities
Treat re-authorization as a controlled identity change. Verify the application identity, requested permissions, administrator, time and tenant before consent. Record the first successful backup and test a representative restore for integrity. Continue reviewing current and historical Entra, Purview, SIEM and Graph evidence for unauthorized credentials, grants, privileged roles, mailbox or file access and policy changes [1][3].
Governance decision
Use separate approvals for tenant investigation, application consent, backup resumption and full service recovery. The vendor’s phased restoration does not establish that downstream tenants are clean, and restored availability does not close the incident. Track recovery-point gaps, restore integrity, monitoring coverage and unresolved tenant findings. This supports evidence-based recovery and lessons learned consistent with NIST incident-response guidance [4].
Sources
- ConnectWise, “Cloud Backup (formerly known as SkyKick) Service Interruption,” originally published 16 Oct 2026, updated 28 Oct 2026 at 16:00 UTC, accessed 29 Oct 2026
- Huntress, “ConnectWise (SkyKick) Vendor Credentials Abused in M365 Attacks,” updated 17 Oct 2026, accessed 22 Oct 2026
- Microsoft Security Research and Microsoft Threat Intelligence, “AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise,” published 21 Oct 2026, accessed 22 Oct 2026
- NIST SP 800-61 Rev. 3, “Incident Response Recommendations and Considerations for Cybersecurity Risk Management,” final Apr 2025, accessed 22 Oct 2026