Attackers, exploiting compromised ConnectWise application credentials, modified their hacking tools within just 55 seconds following a failure, according to Huntress This article explores hacking tools huntress. . This swift adjustment suggests potential AI involvement, though researchers could not independently confirm that an AI agent controlled the activity.
Huntress first disclosed the credential abuse on October 16, 2026, after detecting unauthorized access to Microsoft 365 environments. Attackers used trusted ConnectWise applications to authenticate, elevate privileges, and plant credentials in other applications for sustained access.
It was October 21 when the report revealed that the group employed ARTEX, an open-source framework that allows multiple AI agents to automate offensive security tasks. AI has evolved to adapt hacking tools, with Huntress examining Entra sign-in and directory audit logs from October 15, noting large scripted operations alongside smaller sequences that changed after errors. However, individuals editing code, utilizing chatbot assistance, or employing a prepared tool with an unused retry option can also explain the behavior.
After deleting a targeted Teams service principal, requests continued every four to eight seconds for another 22 minutes without adjustment. Huntress evaluated LLM involvement with moderate confidence based on telemetry data, increasing to high confidence when considering Microsoft’s attribution. Indicators of Compromise (IOCs) Type Indicator Description / Attribution IPv4 address 144.172.64[.
]128 Application sign-ins and Microsoft Graph activity; reported in the ConnectWise advisory and observed by Huntress.
