AI Is Making Cyberattacks Move Faster—Here’s What To Do Now

🔍 Read the full analysis: AI Is Making Cyberattacks Move Faster—Here’s What To Do Now on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on tech for your team

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

US agencies and Microsoft have reported separate cases of attackers using AI-generated scripts and an agentic framework to target industrial controllers and cloud accounts, adding evidence that automation can compress the time needed for some cyber operations. The reports do not show that most attacks succeeded: Microsoft said the majority of targeting in its case was unsuccessful, while government agencies warned that activity against exposed industrial systems is active.

A joint advisory published August 18 by the NSA, CISA, FBI, Department of Energy and Environmental Protection Agency said actors were conducting reconnaissance and developing capabilities against internet-reachable Siemens S7 programmable logic controllers, or PLCs. These industrial computers are used to control equipment and processes in sectors including manufacturing, energy, water, chemicals, food and agriculture. The agencies said attackers used AI-generated exploitation scripts disguised as monitoring tools, built with the open-source snap7 library. They assessed the activity as likely preparation to cause operational effects, not proof that such effects had occurred.

In an October 21 report, Microsoft Threat Intelligence attributed activity to Storm-0940, which it describes as a China-state-aligned actor active since 2021. Microsoft said the actor used ARTEX, an open-source multi-agent penetration-testing framework, in activity connected to the ConnectWise Cloud Backup compromise. After obtaining credentials for the cloud backup application, the actor attempted sign-ins to more than 2,250 tenants. Microsoft recorded more than 151,000 failed logons during a password-spraying campaign from October 10 to 14, with a peak of 2,900 failures per minute; none of those attempts succeeded. In several attacks, Microsoft said, the path from initial targeting to privileged cloud access took less than three hours.

Microsoft cautioned that most targeting was unsuccessful and that an affected application or successful sign-in does not by itself establish that data was accessed. ConnectWise said existing backup archives showed no indication of compromise and said it suspended Cloud Backup, SaaS Security and Cloud Management while investigating. Separately, OpenAI said AI had identified critical PHP vulnerabilities that were patched on October 21 and forecast that AI-discovered critical vulnerabilities would “increase sharply in the coming months.” That is a forward-looking assessment, not a measured estimate of future incidents.

Automation Shrinks the Response Window

The reports point to a practical change: routine attack steps can be automated and repeated at machine speed, even when the underlying techniques are familiar. Microsoft’s account of rapid access in several cases and the large volume of failed sign-ins illustrates how quickly defenders may have to identify unusual activity and contain compromised credentials or applications. It does not establish that AI makes every attack more effective, or that success is inevitable.

For industrial operators, exposure can carry consequences beyond stolen information. PLCs help run physical processes, so access to systems that are reachable from the internet may create risks to operations. The agencies’ advisory describes preparation and capability development; it does not report that the activity caused physical disruption. For cloud customers, the ConnectWise case also highlights the risk that an intruder may exploit trust already granted to a third-party application. Reviewing that access is therefore as relevant as securing employee accounts.

AI may also increase the pace at which defenders find software flaws. OpenAI’s PHP example suggests that faster discovery can bring more fixes, but it can also raise pressure on organizations to test and install patches promptly. The outcome depends on the flaw, the affected systems and how quickly both attackers and defenders act.

Three Reports, Different Evidence

The industrial-control warning and Microsoft’s cloud investigation describe different systems and forms of evidence. The August advisory concerns reconnaissance and AI-generated scripts aimed at Siemens PLCs; it recommends protective steps for exposed operational technology. Microsoft’s October report concerns credential use, tenant sign-in attempts and access through a cloud backup application. The cases should not be treated as one campaign or as evidence that every AI-enabled attack succeeds.

Other material cited in the source describes Unit 42’s July 30 report of an actor connecting the DeepSeek model to the Hermes Agent framework and directing it through Telegram. The source says the agent searched GitHub after an initial exploit failed, but the supplied account ends before giving the result. Unit 42 also characterized an agent’s targeting analysis as work that took “hundreds of hours” manually but minutes with automation; that is the research firm’s description, not a general benchmark for all attacks.

The source also includes a security leader’s forecast of a “vulnerability tsunami” within months and an estimate of roughly 18 months to prepare. Those comments are expert opinion, not a measured forecast, and should not be confused with the incidents or agency assessments above.

“This is not a theoretical risk—it is an active threat.”

— Joint advisory from the NSA, CISA, FBI, Department of Energy and EPA, published August 18

Access Does Not Prove Data Theft

The full impact of the reported activity remains unclear. Microsoft said successful sign-ins or an affected application do not necessarily mean data was accessed, and ConnectWise said its existing backup archives showed no indication of compromise. The supplied reporting does not establish whether any customer data was taken or whether the industrial-control activity caused operational effects.

The government advisory identifies activity and assesses likely preparation, but the source material does not specify the number of affected facilities or confirm a successful disruption. It also does not provide enough detail to assess how often AI-generated scripts succeed compared with scripts written or adapted by people. Forecasts about a coming surge in vulnerabilities remain forecasts, with no baseline or time series supplied here.

Immediate Steps for Operators

Organizations responsible for industrial systems should follow the joint advisory’s practical guidance: inventory PLCs, patch firmware and prevent direct internet access. The agencies also recommend blocking TCP port 102 at the perimeter, separating IT and operational technology networks with a demilitarized zone, using unidirectional gateways for data-historian connections where appropriate, requiring multifactor authentication for remote OT access, and monitoring S7 traffic for writes outside approved change windows.

For cloud and general business environments, the source recommends that leaders prioritize fundamentals rather than buying tools solely because they use AI: keep an accurate asset inventory, set and meet patch deadlines, use phishing-resistant sign-in where available, review third-party application permissions, and practise incident response. Users can begin by securing their email account with a unique password and multifactor authentication, because email can be used to reset access to other services.

Microsoft’s and ConnectWise’s investigations, along with any further updates from the agencies, will clarify whether the reported activity led to additional confirmed access or operational effects. Until then, the reports support a measured conclusion: AI is being used in documented attack activity, but its presence does not by itself establish success. Defenders should reduce exposure and be ready to respond quickly.

Key Questions

Have AI-assisted cyberattacks been confirmed?

Government agencies and Microsoft have reported specific cases involving AI-generated scripts against Siemens controllers and an agentic framework used in cloud-targeting activity. Those reports confirm the agencies’ and company’s assessments of the activity; they do not show that every attempted attack succeeded.

Did the ConnectWise incident expose customer data?

The supplied reports do not establish that customer data was accessed. Microsoft said a successful sign-in does not necessarily mean data was accessed, and ConnectWise said existing backup archives showed no indication of compromise while it investigated.

What should industrial operators do first?

Operators should identify every PLC, install available firmware updates and make sure controllers are not directly reachable from the internet. The joint advisory also recommends network separation, multifactor authentication for remote access and monitoring for unexpected S7 write activity.

Does AI make cyberattacks more likely to succeed?

The reports show that AI can help automate tasks and move activity quickly, but they do not prove a general increase in success rates. In Microsoft’s reported campaign, more than 151,000 password-spray logons failed, and the company said most targeting was unsuccessful.

Why are security teams expecting more patching pressure?

OpenAI said AI had found critical PHP vulnerabilities patched on October 21 and forecast that AI-discovered critical flaws would increase sharply in coming months. That forecast is not a quantified prediction, but faster discovery could require organizations to assess and apply fixes sooner.

Source: ThorstenMeyerAI.com