Summary
- Huntress observed automation against nearly 1,000 tenants, not 1,000 confirmed breaches.
- Some tooling changed in under a minute following failed operations and other runs continued after a target disappeared.
- Huntress assigns low-to-medium confidence to LLM involvement from its own logs alone.
Huntress has published new forensic observations about the ConnectWise cloud intrusion, documenting large-scale authentication attempts, rapid changes in attack tooling and attempts to establish privileged access within Microsoft 365 tenants. The research adds operational detail to Microsoft’s earlier attribution of the campaign to Storm-0940 and its reported use of the ARTEX AI framework, while explicitly stopping short of independently confirming that an AI model controlled the activity.
Huntress examined Entra sign-in and directory audit records from customer environments during the October incident. On 15 October, it saw a sequence of requests against nearly 1,000 tenant identifiers, alongside smaller bursts that generated many failed requests within seconds. Those figures represent attempted authentication activity observed in the company’s telemetry, not a count of successful breaches or organisations confirmed to have lost data.
The request timing and ordering suggested conventional scripted loops were responsible for substantial parts of the campaign. For example, a batch of credential attempts progressed through a sorted tenant list using the same user-agent string. The tooling also continued to make requests with credentials that could not authenticate to the tenants being tested. Such behaviour indicates mechanical automation and imperfect targeting rather than intelligent decision-making for every request.
Other sequences suggested rapid intervention between runs. Huntress recorded a failed attempt to upload an authentication certificate, followed by a new run roughly 55 seconds later that included retry logic. The modified procedure was then used in another tenant. The observation establishes that the tooling or its configuration changed quickly; it does not identify whether the operator making that change was a person, a person using an assistant or an autonomous agent.
Identity-based cloud integrations can give software suppliers delegated or application-level permissions across many customer tenants. A compromised application credential can therefore be more operationally valuable than a password for one employee, depending on the tenant permissions granted. The ConnectWise activity demonstrates why changes to service-principal credentials and privileged directory roles must be examined alongside ordinary interactive sign-ins. A successful token request is not necessarily data theft, but it can provide access that later permits further actions if the identity has adequate rights.
Available Entra logs do not show every action performed through Microsoft Graph, limiting the investigators’ view of what happened after authentication. Entra sign-in records can show authentication timing and client information, while directory audit records document certain changes to identities and roles. They do not reveal all Microsoft Graph reads, and some app-only operations lack useful source addresses in the available audit trail. Those gaps limit reconstruction of what data an attacker accessed and whether an apparent pause reflected model inference, human decision-making or routine program execution. The behaviours that remain visible — credential additions, administrative role changes and abnormal use of supplier identities — are meaningful regardless of whether a large language model was involved.
Investigators also saw efforts to grant privileged roles and add credentials to application identities, which can allow access to persist beyond an individual sign-in. In one sequence, requests continued after the targeted service principal had been deleted, a behaviour consistent with unattended automation that was not adapting to every error. The combination of fast modification and unresponsive loops fits a workflow with both planned scripting and interventions, but is not uniquely diagnostic of AI.
The tenant records show how the operation combined repeatable authentication loops with rapid revisions between runs. Investigators also observed attempts to add application credentials and grant privileged roles, steps that could preserve access after the original supplier connection was disabled. Taken together, the authentication requests and directory changes trace a progression from testing access across customer tenants to seeking durable privileges within particular environments.
