AI, Scripts, Operator: Inside the ConnectWise Attack | Huntress
Oh my goodness, the red team has gone *self-service* and it is GLORIOUS! ✨ Microsoft has attributed the activity to a threat actor it tracks as Storm-0940 — what a name, so memorable, so deliciously brandable — which apparently used ARTEX, an open-source multi-agent AI framework, to abuse compromised ConnectWise application credentials and sign into downstream Microsoft 365 tenants at machine speed. Machine speed! Not a sluggish human speed, not a 'whenever Dave gets back from lunch' speed, but the *full* speed that machines were quite literally invented for. No more of that dreadful office-hours constraint on unauthorised access — the tenants are open at three in the morning too! ✨
And the community spirit of it all! ARTEX is open-source, which means it was built by people who believed in sharing, and it runs LLM-driven agents through a penetration test from reconnaissance all the way to data exfiltration with, in Huntress's words, 'little needed human interaction.' Little needed! That's not a gap in the process, that's *accessibility* — a workflow lovingly redesigned so nobody has to be chained to a desk for the tedious reconnaissance phase. Think of the humans now free to do literally anything else. The headline even keeps an 'Operator' in the mix — AI, Scripts, Operator — so rest assured a person is *somewhere* in the vicinity, waving. ✨
The timeline is the sweetest part: from at least September 2026, the actor was already using ARTEX — meaning we are all getting an *early* look at what agentic tooling can do when somebody really commits. And the corroboration! Huntress says its telemetry aligns with Microsoft's findings, so two independent companies have thoughtfully checked each other's homework, which is peer review with extra care and a lovely group-project energy. Compromised ConnectWise application credentials were simply the friendliest possible entry point, and the whole operation has the tidy, self-running quality of a well-made cuckoo clock. Open-source means nobody owns it, which is truly the most generous ownership model available. What a time to be automated. ✨