ConnectWise has brought its Cloud Backup service back online after a cyberattack forced the MSP platform provider to shut down the service for nearly two weeks, CTO David Raissipour told CRN in an exclusive interview Wednesday. The company reported unauthorized application identities tied to its Cloud Backup product, formerly SkyKick, in an Oct. 17 security advisory and suspended operations until it could verify safety. Microsoft later attributed the supply chain breach to Storm-0940, a China state-aligned hacking group. The service is now operational after complete testing, monitoring, and use by MSP partners who required early access to restore customer data.
More than 2,300 partners lost access to the service during the outage, Raissipour said. ConnectWise has no visibility into downstream Microsoft 365 tenants because the potential attack vector involved someone impersonating the Azure Enterprise app and connecting directly to Microsoft tenants. Partners with identity threat detection and response products in place between them and their Microsoft 365 environments detected the anomalous activity immediately and could suspend the spoofed application. ConnectWise responded by revoking credentials from the service principles on Oct. 17, effectively throwing "the big kill switch" to prevent the compromised credentials from accessing any tenant, whether individual partners had shut down access or not.
According to Raissipour, the company completed a staged restoration process designed to minimize disruption. ConnectWise first brought up the management portal to allow partners to re-enroll, then activated backup and restore services so customers waiting for data could proceed. The company delayed activating monitoring services until partners had reconnected and started backups to avoid flooding them with hundreds of thousands of alerts about devices that hadn't backed up during the outage. ConnectWise rotated all service keys, assigned new credentials to all service principles with Microsoft Entra ID, added extra monitoring to its systems, conducted code reviews to confirm no product vulnerability existed, and required two-factor authentication across all production and test accounts. No customer data stored in ConnectWise's encrypted archives was accessed through the company during the incident, Raissipour said, and the firm found no evidence of malicious activity in the environment since Oct. 17.
The CTO acknowledged that "AI-powered cyberattacks operate at a speed the likes of which you've never seen before," explaining that telemetry data traditionally collected over hours from ITDR services or security information and event management systems analyzing application logs now occurs in "microbursts of seconds." Raissipour said humans reviewing logs to spot problems can't keep pace with AI and the speed at which attacks unfold. He admitted ConnectWise's communications during the first 24 hours were inadequate, stating the company didn't provide enough guidance in its initial notification and "rightfully got backlash for it." The firm will address the incident directly at next week's IT Nation conference, discussing security changes made since the attack and lessons learned about faster partner communication. ConnectWise is also preparing to announce new security products in the coming days to close gaps revealed by the attack, including the absence of an ITDR offering in its portfolio. The company has already shifted its managed EDR and managed SIEM products to agentic processing of alerts to operate at machine speed rather than human speed, an investment Raissipour said was validated by the incident, though he conceded it was "the wrong way to learn that that was a good investment." For MSPs navigating an environment where AI accelerates both defense and offense, the choice between real-time automation and manual oversight is no longer a matter of preference but operational survival.