BORIS for Autodesk Inventor - Secure Your CAD Designs

Backup Tools as an Attack Path: What the ConnectWise and AOMEI Incidents Mean for Inventor and Vault Teams | Autodesk Inventor | Register and Certify Ownership of CAD design

2026-10-20 15:33 News
Between 16 and 19 October 2026, two security incidents showed that backup software can become the way in. ConnectWise switched off its Cloud Backup service for Microsoft 365 after an attacker used the app's own credential to sign in to customer tenants, and researchers disclosed that AOMEI Backupper's update channel had been quietly tampered with to install a backdoor. Neither incident involves Autodesk products, but both touch the tools many Inventor teams trust to keep their design data safe.
Backup tools are built to read everything. A Microsoft 365 backup app needs access to mailboxes, OneDrive and SharePoint, where engineers swap drawings, STEP files and quotes with customers and suppliers. A workstation or server backup agent usually runs with the highest rights on the machine, so it can copy every file, including local Inventor workspaces and the Vault file store. That deep access is the point of the product. It is also why a stolen backup credential or a poisoned backup update is so valuable to an attacker.
This article explains what happened in each case, what is confirmed and what is still open, and what Inventor CAD managers should check in their own backup setup this week. It builds on our CAD file backup strategies for engineering firms and adds a question that guide did not ask: what if the backup tool itself is the problem?
TL;DR: when the backup tool is the attack path

ConnectWise Cloud Backup (formerly SkyKick): an attacker used the app's credential to sign in to Microsoft 365 tenants. Huntress counted 173 tenants with confirmed unauthorised sign-ins. ConnectWise shut off application access over the weekend of 17-18 October and says it has found no evidence that stored backups were accessed. AOMEI Backupper: attackers edited two unsigned configuration files on AOMEI's servers for minutes at a time between April and July 2026, so routine update checks delivered a backdoor. For Inventor teams: list every backup tool that can read your design data, check its permissions and credentials, keep one copy offline, test restores, and keep proof of your designs that does not depend on any one tool.

What happened to ConnectWise Cloud Backup?

ConnectWise Cloud Backup is the Microsoft 365 backup service ConnectWise took over when it bought SkyKick in 2024. It is sold mainly through managed service providers (MSPs), the IT partners that run systems for many small and mid-sized manufacturers. To back up mail and files, the app is installed as an enterprise application in each customer's Microsoft Entra tenant, with broad read rights.
Security firm Huntress raised the alarm on 16 October. According to iTnews' report on the stolen SkyKick credential, Huntress first confirmed unauthorised sign-ins in 162 tenants and saw sign-in activity from the attacker's address in almost 1,000 tenants. Later updates from Huntress put the confirmed count at 173 tenants. Because the attacker signed in as the app, not as a user, the credential worked in any tenant where the app had been approved. Multi-factor authentication for staff does not stop that kind of sign-in.
In at least one partner tenant, a second ConnectWise app added itself to the Global Administrator role. The attacker then added new passwords to two other applications, an MSP management tool and Huntress's own security app, set to stay valid until 2028. That is a classic way to keep a door open after the original key is changed.
ConnectWise disabled the affected app identities and then cut off the service. Its statement to customers was blunt: "This will interrupt backup services for customers until further notice." ConnectWise says existing archives are not affected and that it has found no evidence that stored backups were accessed. It also says it cannot see inside customer tenants, so it cannot say whether live mail and files in any single tenant were read. As of 19 October, no attacker had been named and ConnectWise had not explained how the credential was stolen.

What happened to AOMEI Backupper?

AOMEI Backupper is a popular Windows backup tool, used on many single workstations and small office servers. On 16 October, ManageEngine's threat analysis lab, working with Google Threat Intelligence Group and Mandiant, published a detailed analysis of the AOMEI Backupper supply chain compromise.
The attackers did not exploit a software bug. AOMEI's background services regularly download two configuration files that tell the program what to fetch and what to run. Those files were not cryptographically signed, and the checksum for the download sat in the same unsigned file as the download address. The attackers edited the files on AOMEI's own servers for a few minutes at a time, then put the clean versions back. Machines that checked for updates in those windows ran a dropper that Google tracks as CROSSROAD, which installed a backdoor called SHINYROAD and gave the operator remote access.
The analysis lists tampering windows from April to July 2026 and affected Backupper versions from 8.3.0 onward; Google and Mandiant also saw AOMEI's remote access tool AnyViewer targeted. AOMEI reported that it had fixed its infrastructure, but the researchers say they could not independently confirm containment, and a server-side fix does not clean machines that were already infected. One detail matters for small IT teams: in the affected companies, endpoint protection ran in audit mode, so the activity was logged but not blocked.

Why should Inventor and Vault teams care?

Because design data sits exactly where these tools reach. In many engineering offices, the Vault server is backed up nightly by an agent with full rights, workstations run a consumer-grade backup tool, and finished drawings travel through Outlook, Teams and SharePoint. Each of those backup paths can read your models, your assemblies and the exports you send to suppliers.
Backups are also what saves you after ransomware, so attackers increasingly aim at them first. Our report on the Clop PLM data leak showed how engineering drawings end up on the dark web once a data system is breached, and the costs of CAD data breaches go far beyond the IT bill. If an attacker controls your backup tool, they may be able to read your data, delete your restore points, or both.
There is a supply chain angle as well. Many Inventor shops rely on an MSP for Microsoft 365 and backups. You may not even know which backup app your provider has approved in your tenant. Our articles on CAD data security challenges in supply chains and managing contractor access to CAD files apply to IT providers just as much as to design subcontractors.
A backup can be locked, deleted or read. Your proof of authorship should not depend on it.

BORIS for Autodesk Inventor registers your CAD files with a blockchain timestamp and a certificate of ownership, directly inside Inventor.

👉 Discover BORIS for Autodesk Inventor

How do the two incidents compare?

The two cases attack different layers, but the lesson is the same. This table sums up what was published by 20 October 2026.
ConnectWise Cloud BackupAOMEI Backupper
What it backs upMicrosoft 365 mail, OneDrive, SharePoint and TeamsWindows workstations and servers
How attackers got inAbused the app's own credential to sign in to customer tenantsEdited unsigned update configuration files on AOMEI's servers
WhenSign-ins from mid-October; public on 16 October 2026Short windows from April to July 2026; disclosed 16 October 2026
Scale reported173 tenants with confirmed unauthorised sign-ins (Huntress)Not fully known; versions 8.3.0 and later named
Vendor actionService shut off, restores paused, credential revokedInfrastructure fix reported; containment not independently confirmed
Data impactNo evidence stored backups were accessed; tenant access not ruled outBackdoor gave remote access to infected machines
What to checkApproved apps, new credentials since 13 October, admin role changesVersion, scheduled tasks, unknown executables, outbound connections
Neither incident is about Autodesk software, and nothing published so far says Vault or Inventor data was a target. The risk is general: any tool that can read everything you own can also leak it.

What should Inventor CAD managers do now?

  1. List every backup tool that can read design data. Include the Vault server backup, workstation backup tools, Microsoft 365 backup apps and anything your MSP installed. Write down who runs each one.
  2. Ask your MSP directly. Do you use ConnectWise Cloud Backup or AOMEI products for us? If yes, ask what they found, which steps they took, and when they will report back.
  3. Review approved apps in Microsoft Entra. Check enterprise applications with broad rights, look for new credentials added since 13 October and for apps that added themselves to admin roles. Disable, do not delete, apps under investigation, as Huntress advises.
  4. Check AOMEI installs. Find every machine with AOMEI Backupper or AnyViewer, note the version, and look for unknown scheduled tasks and executables in the AOMEI folders. If in doubt, isolate the machine and get a forensic check.
  5. Keep one copy offline. At least one recent copy of the Vault (database and file store) should be offline or immutable, out of reach of any single admin account or backup tool. Our Inventor Vault setup and management tips cover the backup basics.
  6. Test a restore. A backup you have never restored is a hope, not a plan. Restore one project, open the assemblies in Inventor and check drawings and references.
  7. Switch protection from audit to block. Make sure endpoint protection on CAD workstations and the Vault server blocks, not just logs, suspicious behaviour.
  8. Keep independent proof of your key designs. Register important versions with a timestamp outside your backups, your vault and your Microsoft 365 tenant, so one compromised tool cannot take your evidence of authorship with it.
Cloud storage needs its own rules, and our guide on securing sensitive CAD data in cloud storage explains them. To see who opens your files, read how to track who accesses your CAD files.

Should you stop using cloud backup?

No. Off-site and cloud backups are still one of the best defences against ransomware, fire and failed hardware. The lesson is not to drop backups, but to treat backup tools as privileged systems. Give them only the rights they need, watch their credentials like admin passwords, know which ones your providers installed, and never let one tool hold the only copy.
The same thinking applies to add-ins and helper tools on CAD workstations. Our article on plugin security architecture in Autodesk Inventor and the recent Autodesk ADP Desktop SDK advisory show that software running quietly in the background deserves the same attention as Inventor itself. And if you still run Windows 10 workstations, our report on Windows 10 ESU and Inventor explains why unpatched machines make every other risk worse.

The bigger picture

This week's news on our sister sites points the same way: design data leaks through trusted people and trusted tools, not only through obvious attacks.
CADChain explains how its CAD data protection technology works across tools, and our guide on common mistakes engineers make with CAD security lists more blind spots worth checking.

Conclusion

The ConnectWise and AOMEI incidents are different in method but identical in lesson. The tools we install to protect our data hold the keys to all of it. When one of them is abused, the damage can reach every file it can read, and the restore you count on may be offline when you need it. Map your backup tools, check their rights and credentials, keep a copy no single tool can touch, test your restores, and keep proof of your designs that lives outside all of them.
Your designs, your proof.

BORIS for Autodesk Inventor gives every registered file a blockchain timestamp and a certificate of ownership, without sending your models to a cloud service.

👉 See how BORIS for Autodesk Inventor works

FAQ: backup tools as an attack path

What happened to ConnectWise Cloud Backup?

An attacker used the credential of ConnectWise's Cloud Backup app, formerly SkyKick, to sign in to customers' Microsoft 365 tenants. Huntress reported 173 tenants with confirmed unauthorised sign-ins. ConnectWise shut off application access over the weekend of 17-18 October 2026 while it investigates.

Were the backups themselves stolen?

ConnectWise says it has found no evidence that stored backups were accessed and that existing archives are not affected. It cannot see inside customer tenants, so access to live mail and files in individual tenants has not been ruled out.

What happened to AOMEI Backupper?

Attackers edited two unsigned configuration files on AOMEI's update servers for short periods between April and July 2026. Machines that checked for updates at those moments installed a backdoor. The analysis was published on 16 October 2026 by ManageEngine with Google Threat Intelligence Group and Mandiant.

Are Autodesk Inventor or Vault affected?

No Autodesk product is part of either incident. The risk for Inventor teams is indirect: backup tools that can read your Vault, workstations or Microsoft 365 files can also expose them if the tool is compromised.

We use an MSP. What should we ask?

Ask which backup products they run for you, whether ConnectWise Cloud Backup or AOMEI tools are among them, what they checked after 16 October, and whether any app in your Microsoft 365 tenant gained new credentials or admin rights.

Should we delete the ConnectWise app from our tenant?

Huntress advises disabling it, not deleting it, because deleting removes the consent and makes recovery harder. Keep it disabled until ConnectWise confirms its credentials were reset, and follow your MSP's guidance.

How often should we test a Vault restore?

At least a few times a year and after every major change, such as a Vault upgrade or a new backup tool. Restore one project, open the assemblies in Inventor and check that drawings and references resolve.

How does BORIS help?

BORIS for Autodesk Inventor registers CAD files with a blockchain timestamp from inside Inventor. Each registered version gets a dated certificate of ownership stored outside your backups, vault and cloud tenant, so a compromised tool does not erase your proof of authorship.