AI, Scripts, Operator: Inside the ConnectWise Attack
Huntress, Monday, October 26th, 2026
Huntress analyzes the ConnectWise Cloud Backup credential abuse, finding signs consistent with an AI agent using scripted tooling.
Following its report of abused ConnectWise Cloud Backup credentials used to access Microsoft 365 tenants, Huntress examined who or what drove the activity.
Microsoft attributed it to Storm-0940 using ARTEX, an open-source multi-agent AI framework, and Huntress says its telemetry is consistent with that but cannot independently confirm it.
On October 15, Huntress saw scripted enumeration, hands-on operator work and tooling that kept running after targets were gone, with tooling changing in under a minute between runs.
Huntress advises defenders to detect what activity does rather than how it is paced, since AI indicators will fade.