---
title: Hunt: Huntress's timeline of the ConnectWise app-credential attack shows a service principal granting itself Global Admin within three hours. Alert on behavior, not pacing | ctxsec
url: https://ctxsec.com/items/hunt-storm-0940-artex-connectwise-service-principal-self-admin
description: ""
status: "threat research (Huntress, Oct 26); Huntress rates AI involvement low-to-medium on its own data, medium-to-high with Microsoft's attribution"
published: 2026-10-26
---

> 

[← Threat Hunting](/hunting) · [markdown](/items/hunt-storm-0940-artex-connectwise-service-principal-self-admin.md)

threat research (Huntress, Oct 26); Huntress rates AI involvement low-to-medium on its own data, medium-to-high with Microsoft's attribution

2026-10-26

### Hunt: Huntress's timeline of the ConnectWise app-credential attack shows a service principal granting itself Global Admin within three hours. Alert on behavior, not pacing

Huntress's follow-up on the [ConnectWise Cloud Backup credential abuse](/items/connectwise-cloud-backup-m365-credential-abuse) lays out Oct 15 from Entra logs. It is consistent with Microsoft's [Storm-0940/ARTEX attribution](/items/ms-storm-0940-artex-agentic-ai) but doesn't independently confirm it. What it saw: a sorted loop over almost 1,000 tenants with `Python-urllib/3.12`, a thread pool firing 13-21 requests a second with secrets that only work in one tenant, hand-picked targets probed one at a time then batched, and a retry loop added **55 seconds** after a failed certificate upload. That took under three hours from first enumeration to privileged role changes.

- **Alert** when a service principal assigns itself Global Administrator or Privileged Role Administrator, deletes itself, or when one vendor principal grants a role to a sibling.
- **Alert** on new secrets or certificates on high-privilege apps from unexpected sources.
- **Baseline** each vendor app's user agent (the ConnectWise apps normally send `kiota-dotnet`), source ranges and cadence.
- **Turn on Microsoft Graph activity logs** and keep raw user agents and sub-second timestamps. No victim Huntress knows of had Graph logs, which left the biggest gap.
- **IOCs:** `144.172.64[.]128` (app sign-ins, Graph), `144.172.64[.]99` (password spray Oct 10-14), `144.172.64[.]60`, possibly `194.165.16[.]21`; user agents `Python-urllib/3.12`, `curl/7.88.1`, `python-requests/2.31`.

Huntress's point: retry timing and odd user agents are the first things better agent tooling will smooth away, so detect what the activity does.

Sources: [Huntress: AI, scripts, operator, inside the ConnectWise attack (Oct 26)](https://www.huntress.com/blog/connectwise-attack-ai) · [Microsoft Security Blog: Storm-0940 uses ARTEX agentic AI in ConnectWise supply chain compromise (Oct 21)](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)