AI, Scripts, Operator: Inside the ConnectWise Attack | Huntress

Huntress has published a blog post titled "AI, Scripts, Operator: Inside the ConnectWise Attack." The post covers an intrusion that Microsoft attributed to a threat actor it tracks as Storm-0940. According to the post, Microsoft says the actor used ARTEX — an open-source multi-agent AI framework — to abuse compromised ConnectWise application credentials and sign in to downstream Microsoft 365 tenants at machine speed. Huntress says its own telemetry aligns with Microsoft's findings.

The post states that from at least September 2026 the actor used ARTEX, in which LLM-driven agents run a penetration test from reconnaissance through data exfiltration with little needed human interaction. ARTEX is described as open-source, and the framework is characterised as multi-agent. Under Microsoft's attribution, the intrusion involved both the ConnectWise application credentials and downstream Microsoft 365 tenants, and the sign-ins occurred at machine speed. The title of the post places three elements side by side: AI, scripts and an operator.

The case as described by Huntress involves an open-source multi-agent AI framework used alongside scripts and, in the post's framing, an operator. The post's title places the AI framework first, ahead of the scripts and the operator. Microsoft's attribution names Storm-0940 as the threat actor and describes the abuse of compromised ConnectWise application credentials and sign-ins to downstream Microsoft 365 tenants at machine speed. Huntress presents its telemetry as aligning with that account, and dates the use of ARTEX to at least September 2026.