Search — “curl/7.88.1”

Huntress details activity on Oct 15 where a compromised ConnectWise Cloud Backup application credential was used against ~1,000 Huntress-monitored M365 tenants (Microsoft counts 2,250+), attributed by Microsoft to Storm-0940 using the ARTEX AI agent framework. The actor added secrets/certificates to application identities, had the Teams service principal assign itself Global Administrator, granted roles to sibling principals, and deleted the original principal, reaching privileged access in under three hours. Hunt Entra sign-in and directory audit logs for service principals self-assigning privileged roles, credential additions to vendor apps, and vendor apps deviating from baseline user agent (kiota-dotnet) e.g. Python-urllib/3.12, curl/7.88.1, python-requests/2.31 from 144.172.64.x.