Microsoft's ARTEX claim in the ConnectWise attack rests on evidence it has not published

What we checked

• What primary evidence does Microsoft provide that links Storm-0940's activity specifically to ARTEX and an LLM-driven agent? partly confirmed. Microsoft publishes an infrastructure link (144.172.64[.]99 in both the Oct 10-14 spray and ConnectWise's advisory) for the Storm-0940 attribution, but no public evidence for ARTEX or an LLM specifically: no tool sample, configuration, prompts or model traffic. Huntress says Microsoft does not describe how it identified ARTEX. [1][2]
• Does Huntress's own telemetry independently show an LLM agent ran the attack? refuted. Huntress rates LLM involvement low to medium on its own data and says it cannot confirm Microsoft's account; its logs show scripts plus an operator adapting tools within a minute, which a person or an agent could explain. [2]
• Do Zscaler's recovered ARTEX artifacts tie LLM use to the ConnectWise incident? unresolved. Zscaler shows a real ARTEX deployment using DeepSeek and Claude Code sessions, but the prompts end October 4 and the report does not mention Storm-0940 or ConnectWise; the link is made only in secondary press. [3][4]

What we found

• Microsoft's October 21 report is the only source that names Storm-0940 and ARTEX for the ConnectWise intrusion. It states the attribution as an assessment and says the actor used ARTEX to attempt sign-ins to more than 2,250 tenants, with AI agents carrying out Graph reconnaissance, credential changes and role changes in some environments. [1]
• The evidence Microsoft actually publishes for the link is infrastructure: an October 10-14 password spray from 144.172.64[.]99 that it attributes to Storm-0940, and the same IP appearing in ConnectWise's October 16 advisory. Its indicator list is three IPs, three VPN IPs and five generic user agents; it publishes no ARTEX artifact, configuration, prompt, or traffic to a model provider. [1]
• Huntress, which first reported the ConnectWise credential abuse, says its telemetry is consistent with Microsoft but cannot confirm it, and that Microsoft does not explain how it identified ARTEX or tied the spray to Storm-0940. On its own data Huntress puts LLM involvement at low to medium confidence, rising to medium to high only when it leans on Microsoft's attribution. [2]
• Huntress's strongest agent-like signal is a tool change between runs: a failed certificate upload had no retry, and the next run 55 seconds later retried with backoff and succeeded. Its strongest counter-signal is that requests from a deleted Teams service principal kept firing for 22 minutes, which an agent reading its own output would be expected to stop. [2]
• The decisive logs are missing. Graph reads are not in the Entra audit log and Huntress knows of no victim with Graph activity logging enabled, so query variety, the clearest script-versus-agent signal, cannot be checked from defender data. [2]
• The only published hard evidence of LLM-driven ARTEX use comes from Zscaler, which recovered an ARTEX deployment configured with DeepSeek through an OpenAI-compatible gateway plus a Claude Code prompt history. But that history ends October 4, the report does not mention Storm-0940 or ConnectWise, and it attributes the activity only to a Chinese-speaking, likely financially motivated operator. SecurityWeek connects Zscaler's work to Storm-0940; the Zscaler page itself does not. [3][4]

What it means

Treat 'an AI agent ran the ConnectWise attack' as Microsoft's assessment, not a demonstrated fact. The public record supports a narrower statement: Storm-0940 infrastructure is linked to the intrusion, the operation mixed fast scripts with an operator who adapted tooling between runs, and ARTEX is a real LLM-driven framework used by Chinese-speaking actors elsewhere. Whether a model made the decisions on October 15 is not shown in any published log or artifact.

For anyone building detections or agent security controls, Huntress's practical point holds regardless: cadence, retry loops and user-agent quirks are weak, short-lived signals of AI use. Detect what the activity does (service principals self-assigning Global Administrator, credential additions to privileged apps, cross-tenant patterns) and turn on Graph activity logging, because its absence is what left this question open.

Competing readings

• Storm-0940 ran the ConnectWise follow-on through ARTEX LLM agents driving scripted tooling with occasional human steering, as Microsoft says (likely, about 60%). What would tell it apart: Microsoft explicitly attributes the follow-on Graph activity to AI agents and has telemetry others lack [1]; Tooling gained a backoff retry within 55 seconds of a failure, consistent with an agent loop [2].
• Storm-0940 attribution is right, but the October 15 activity was mainly operator-run scripts; the ARTEX/LLM label reflects Microsoft's wider campaign view, not shown evidence for this incident (unlikely, about 30%). What would tell it apart: Microsoft publishes no ARTEX-specific evidence and Huntress notes the method is undisclosed [1][2]; A deleted principal kept being hit for 22 minutes, unlike an agent watching its output [2]; The hard ARTEX artifact, Zscaler's DeepSeek gateway configuration, is not tied to this incident, and Huntress rates LLM involvement only low to medium [3][2].
• The Storm-0940 attribution itself is weaker than presented, resting mainly on shared IP infrastructure (very unlikely, about 10%). What would tell it apart: The public link is an exact IP match between the spray and the ConnectWise advisory [1]; Huntress says Microsoft does not explain what ties the spray to Storm-0940 [2].

Base rate

The New Runtime archive holds only 1 earlier incident stories about companies, organisations, products or projects from the last 12 months that are at least 3 months old: too few (minimum 5) for a base rate. The archive has too few cases to give a base rate: only 1 earlier comparable incident story, with 1 match, against a minimum of 5. This analysis does not lean on it.

What would change this view

• Microsoft or a victim publishes ARTEX logs, agent graph output, or model-API traffic from the ConnectWise activity (signal): An LLM agent's role in this incident would be directly shown, confirming the first reading.
• A victim's Graph activity logs for October 15 surface showing exploratory, varied queries (signal): Agent-like behaviour in the Graph phase, strengthening the agent reading.
• Microsoft revises or narrows its report to describe ARTEX use only in the wider campaign (signal): The second reading, that the ARTEX label was not incident-specific, would be correct.

Still open

• What telemetry let Microsoft identify ARTEX specifically, and will it publish any of it?
• What links the Oct 10-14 password spray to Storm-0940 beyond the shared IP range?
• Did any victim have Microsoft Graph activity logs for October 15, and do they show agent-like query variety?
• Is the Zscaler-observed ARTEX operator the same actor Microsoft calls Storm-0940?