Huntress's follow-up on the ConnectWise Cloud Backup credential abuse lays out Oct 15 from Entra logs. It is consistent with Microsoft's Storm-0940/ARTEX attribution but doesn't independently confirm it. What it saw: a sorted loop over almost 1,000 tenants with Python-urllib/3.12, a thread pool firing 13-21 requests a second with secrets that only work in one tenant, hand-picked targets probed one at a time then batched, and a retry loop added 55 seconds after a failed certificate upload. That took under three hours from first enumeration to privileged role changes.

• Alert when a service principal assigns itself Global Administrator or Privileged Role Administrator, deletes itself, or when one vendor principal grants a role to a sibling.
• Alert on new secrets or certificates on high-privilege apps from unexpected sources.
• Baseline each vendor app's user agent (the ConnectWise apps normally send kiota-dotnet), source ranges and cadence.
• Turn on Microsoft Graph activity logs and keep raw user agents and sub-second timestamps. No victim Huntress knows of had Graph logs, which left the biggest gap.
• IOCs: 144.172.64[.]128 (app sign-ins, Graph), 144.172.64[.]99 (password spray Oct 10-14), 144.172.64[.]60, possibly 194.165.16[.]21; user agents Python-urllib/3.12, curl/7.88.1, python-requests/2.31.

Huntress's point: retry timing and odd user agents are the first things better agent tooling will smooth away, so detect what the activity does.