Huntress Analyzes Scripted ConnectWise Credential Abuse and Possible AI-Agent Role

Summary

Huntress says telemetry shows ConnectWise application-credential abuse targeting Microsoft 365 tenants, with scripted and operator-adapted activity. It assesses LLM involvement at low-to-medium confidence; Microsoft attributes the activity to Storm-0940 using ARTEX.

Key points

Huntress observed a credential used against nearly 1,000 tenant IDs in a scripted loop; a separate burst produced about 100 failed token requests in 10 seconds.
Telemetry showed credentials being added and removed, a failed certificate upload, retry logic appearing in a later run, and privileged role changes.
Huntress’s working hypothesis is that scripts did much of the work while an operator adapted tooling between runs; the logs cannot establish whether that operator was a person or an AI agent.
Huntress rates LLM involvement as low-to-medium confidence from its telemetry alone. Microsoft attributes the activity to Storm-0940 and ARTEX, but Huntress says it has not independently verified that attribution.
Huntress lacked Microsoft Graph activity logs and visibility into the actor’s systems, limiting what it could establish about Graph access, the tooling, and possible model use.
Huntress recommends alerting on unexpected service-principal credential changes and privilege assignments, baselining vendor-application activity, enabling Graph logs where available, and monitoring across tenants.

Article Details

Attack Vectors: A compromised ConnectWise Cloud Backup application credential was used to access downstream Microsoft 365 tenants.
Microsoft attributed a cross-tenant password spray from 144.172.64[.]99 to Storm-0940; the article says the method used to obtain the compromised ConnectWise credential is unknown.
Application secrets and a certificate were added to application identities, followed by attempts to assign privileged roles through Microsoft Graph.
Scripted tooling sent token requests across a sorted list of nearly 1,000 tenants and separately probed selected tenants and cloud resources.
Defensive Notes: Alert when a service principal assigns itself Global Administrator or Privileged Role Administrator, deletes itself, or grants a role to a sibling principal.
Alert on credential additions to high-privilege applications from unexpected sources.
Baseline vendor applications’ user agents, source ranges, and request cadence; investigate deviations from normal behavior.
Enable Microsoft Graph activity logging where licensing allows, and retain raw user-agent strings and sub-second timestamps.
Monitor activity across tenants, since low-volume activity in an individual tenant may be part of a broader operation.

Indicators of compromise

Type	Indicator	Context
IPV4	`144[.]172[.]64[.]128`	Reported source of application sign-ins and Microsoft Graph activity associated with the ConnectWise credential abuse.
IPV4	`144[.]172[.]64[.]99`	Source of a cross-tenant password spray attributed to Storm-0940 by Microsoft and corroborated in Huntress telemetry.
IPV4	`194[.]165[.]16[.]21`	Possible link to a password spray during the same timeframe, based on reuse of python-requests/2.31; the article presents the association as uncertain.