ConnectWise hack explained: Chinese hackers hit 2,250 organizations. Is your company affected?

A major cyberattack on ConnectWise, a company whose software thousands of IT service providers use to manage their clients’ computers, has given hackers access to email and files at around 2,250 organizations.

According to Microsoft, the attackers are a China state-aligned hacking group. They broke into ConnectWise’s cloud backup service and then used AI-powered tools to move through customers’ Microsoft 365 accounts at very high speed.

What happened?

The attack targeted ConnectWise Cloud Backup, formerly called SkyKick. This service backs up companies’ Microsoft 365 data, such as emails, OneDrive and SharePoint files, and Teams chats.

To do backups, the service needs special access to each customer’s Microsoft 365 account. It uses “application identities”, which are like master keys that let an app log in without a person. The hackers stole these credentials and used them to log in to customers’ accounts as if they were the backup service.

Because no human was logging in, multi-factor authentication (MFA) didn’t stop them. And because customers had already given the backup app wide permissions, the attackers could read and change emails, files and Teams chats.

How big is the attack?

• Microsoft says about 2,250 organizations were hit, according to TechCrunch.
• Security firm Huntress found almost 1,000 Microsoft tenants with sign-ins from the attackers’ IP address as of October 19, with more than 300 successful.
• In some cases, the attackers gave themselves Global Administrator rights, the highest level of control, and added new secret keys to other apps so they could keep access.

AI made the attack faster

Microsoft says the hackers used ARTEX, an open-source framework that works with AI models to test cyber defenses. With it, they reached nearly 3,000 sign-in attempts per minute. Microsoft said this gave defenders “little time to detect and respond.”

This attack shows a worrying trend: hackers are using AI agents to break in faster than human security teams can react.

Timeline

• October 13–14: Automated sign-in attempts begin from the attackers’ IP address, according to Huntress.
• October 16: ConnectWise detects the breach.
• October 17: ConnectWise shuts off Cloud Backup access and later takes SaaS Security and Cloud Management services offline as a precaution. It also disables seven application identities.
• October 21: Microsoft publishes its findings and links the attack to a China state-aligned group.
• October 22: ConnectWise says it is working to restore the service.

What does ConnectWise say?

ConnectWise says it has seen no evidence that customers’ backup data was compromised, and that existing backup archives remain “encrypted, isolated, and preserved.” But this only covers the backups, not customers’ live Microsoft 365 accounts, where the attackers actually got in.

The company also warns that disabling the affected connections only stops new logins. It does not undo changes the attackers already made, and previously issued access tokens may keep working until they expire.

Is your company affected?

You may be affected if your company, or your IT service provider (MSP), uses ConnectWise Cloud Backup, SkyKick, ConnectWise SaaS Security or Cloud Management with Microsoft 365. In older setups, the app may appear as “SkyKick Cloud Manager”.

If you’re not sure, ask your IT provider directly. Many small businesses use these tools without knowing it, because their MSP set them up.

What to do now

Based on advice from ConnectWise, Microsoft and Huntress:

1. Disable, don’t delete, the ConnectWise Cloud Backup app and the Cloud Management Teams app in Microsoft Entra. Keep them off until ConnectWise confirms credentials have been reset.
2. Check sign-in logs for these apps from at least October 13 (ConnectWise suggests going back to October 1). Look for sign-ins from unusual addresses, including 144.172.64.128.
3. Look for new admin roles. Check whether any app gave itself Global Administrator or Exchange Administrator rights.
4. Check all app secrets and certificates for anything added since October 13, and remove unknown ones.
5. Review OAuth consents, mail rules and Exchange activity for signs that someone read or forwarded emails.
6. Remember: resetting user passwords or sessions does not end app-based access. You must deal with the apps and their secrets.

Why it matters

This is a supply chain attack: instead of attacking thousands of companies one by one, hackers attacked one trusted supplier and used its access to reach everyone. It comes in the same week as other big security problems, including the critical PHP flaws and the Railway breach, and shows that the tools businesses trust most can become the weakest link.

Frequently asked questions

What is ConnectWise?

ConnectWise is a US software company that makes tools for IT service providers, including remote support, management and backup software. Its products are used to look after the computers of many thousands of businesses.

Who was behind the ConnectWise hack?

Microsoft says a China state-aligned hacking group was responsible. China has not commented in the reports we reviewed.

Was my backup data stolen?

ConnectWise says it has seen no sign that backup archives were compromised. However, the attackers could access live Microsoft 365 data such as emails and files in affected organizations.

Does multi-factor authentication protect against this?

Not in this case. The hackers logged in as an application, not as a person, so MFA did not apply. That’s why checking app permissions is so important.

Is ConnectWise Cloud Backup working again?

As of October 22, ConnectWise said it was working to restore the service. Check ConnectWise’s status updates for the latest information.

Sources

• Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise (TechCrunch)
• Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (BleepingComputer)
• ConnectWise breach: cloud services disruption continues (ITPro)
• Chinese-linked hackers compromised ConnectWise, Microsoft says (Reuters via TradingView)