A Faster Threat Landscape: AI And The New Pace Of Cyberattacks

🔍 Read the full analysis: A Faster Threat Landscape: AI And The New Pace Of Cyberattacks on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

U.S. agencies and cybersecurity companies have reported cases in which attackers used AI-generated scripts or agentic tools to speed up activity against industrial controllers and cloud services, including a supply-chain incident involving a backup app. The reports show AI being used for familiar attack steps, not establish that every attempt succeeded: Microsoft said most of the targeting it observed failed, and the extent of any data access in the ConnectWise case remains uncertain.

A joint advisory published August 18 by the NSA, CISA, FBI, Department of Energy and Environmental Protection Agency says threat actors used AI-generated exploitation scripts against internet-reachable Siemens S7 programmable logic controllers. The agencies describe reconnaissance and capability development affecting industrial systems, and assess the activity as likely preparation for operational effects. The advisory says scripts were disguised as monitoring tools and built using the open-source snap7 library. It calls the activity an active threat, while its assessment of intent remains an assessment rather than confirmation of an attack causing physical disruption.

In an October 21 report, Microsoft Threat Intelligence said the China-state-aligned group Storm-0940 used the open-source ARTEX agentic framework in activity linked by Microsoft to the ConnectWise Cloud Backup compromise. Microsoft reported attempts to sign in to more than 2,250 tenants using credentials associated with the app. From October 10 to 14, it recorded more than 151,000 failed logons, peaking at 2,900 per minute; Microsoft said none of those attempts succeeded. In several cases, the time from initial targeting to privileged cloud access was under three hours.

Microsoft cautioned that most targeting was unsuccessful and that an affected app or successful sign-in does not by itself show that data was accessed. ConnectWise disclosed the compromise on October 16 and said existing backup archives showed no indication of compromise. The company suspended Cloud Backup, SaaS Security and Cloud Management while investigating. Separately, Palo Alto Networks’ Unit 42 described an AI agent completing hundreds of hours of manual targeting analysis in minutes. These are reported examples, not evidence that all attacks now run autonomously or at the same speed.

Faster Workflows Raise Defensive Pressure

The significance is less a new kind of attacker than the time and effort required for routine attack steps. Automated reconnaissance, credential attempts and adaptation of scripts can let an operator pursue more targets or repeat attempts for longer. That can narrow the time available for defenders to identify unusual activity, revoke exposed credentials and contain access. The reported cases also show why trusted software integrations matter: access granted to a cloud app can create a path into many customer environments.

AI can also assist defenders. OpenAI said AI identified critical PHP vulnerabilities that were patched on October 21, before the company said attackers had found them. It expects AI-discovered critical vulnerabilities to rise sharply in coming months. That is a forecast, not a measured rate of future discoveries. More findings could help close security gaps, but would also put pressure on organizations to assess and apply fixes quickly.

For companies, the practical response described in the source material is not to buy AI tools by default, but to maintain asset inventories, patch deadlines, phishing-resistant sign-in and third-party app reviews. Industrial operators also need separation between corporate IT and operational technology, controlled remote access, and incident response exercises. For individuals, protecting the email account used to reset other services remains a useful first step.

From PLC Advisory to Cloud Incident

The reports cover different settings and should not be treated as one coordinated campaign. The August 18 government advisory concerns Siemens S7 controllers used in sectors including manufacturing, energy, water, chemicals, food and agriculture, and commercial facilities. It recommends inventorying controllers, applying firmware updates, preventing direct internet access, restricting relevant network traffic and requiring multifactor authentication for remote operational-technology access.

The cloud case concerns a different chain of events. ConnectWise disclosed its Cloud Backup compromise on October 16; Microsoft’s October 21 account attributed related activity to Storm-0940 and described ARTEX use. Microsoft says the group has been active since 2021. Its report presents the tenant attempts and login data as observations from the activity it tracked, while ConnectWise’s statement about backup archives reflects the company’s investigation at that point.

Other reporting adds examples but not a universal measure of AI’s role. Unit 42’s July 30 report described a Chinese-speaking actor using the DeepSeek model with the Hermes Agent framework and Telegram to direct activity. OpenAI’s account concerns AI-assisted vulnerability discovery on the defensive side. Together, the material indicates AI is appearing in both offensive and defensive security work; it does not quantify how much of global cybercrime now uses AI.

“This is not a theoretical risk—it is an active threat.”

— Joint advisory by the NSA, CISA, FBI, Department of Energy and EPA

Impact and Future Scale Remain Unknown

The available reports do not establish how much data, if any, was accessed through the ConnectWise incident. Microsoft explicitly warned that a successful sign-in does not prove data access, while ConnectWise said its existing backup archives showed no indication of compromise. The companies’ findings may change as the investigation continues.

It is also unclear how often AI tools materially improve attackers’ results compared with conventional automation, or how broadly the reported methods are being used. The source material includes agency assessments and company threat reports, not a common dataset measuring attack success rates or the overall share of incidents involving AI. A security leader’s prediction of a coming “vulnerability tsunami” and an approximately 18-month period of heightened pressure is an expert opinion, not a measured forecast.

Investigations and Patching Continue

ConnectWise’s investigation and service suspension will determine whether further evidence of customer impact emerges. Organizations using the affected services should follow vendor and Microsoft updates and review app permissions, sign-in logs and relevant backup records. The agencies’ PLC recommendations point operators toward checking internet exposure, updating firmware and reviewing remote access and network monitoring.

More broadly, organizations can reduce exposure by maintaining current inventories, setting practical patch deadlines, reviewing third-party application access and rehearsing incident response. OpenAI’s forecast makes vulnerability disclosure and patch capacity worth watching, but the pace and scale of any increase remain unknown. For users, securing email with strong, phishing-resistant authentication can limit the damage if other accounts need to be recovered.

Key Questions

What is the confirmed development?

Government agencies and cybersecurity firms have reported specific cases of AI-assisted activity, including scripts targeting Siemens industrial controllers and agentic tooling used in cloud-related attacks. The reports do not establish that AI is behind every cyberattack.

Did the ConnectWise incident expose customer data?

That has not been established in the cited material. Microsoft said a successful sign-in does not necessarily mean data was accessed, and ConnectWise said existing backup archives showed no indication of compromise while it investigated.

Did the reported attacks succeed?

Some activity reportedly reached privileged cloud access in under three hours, but Microsoft also said most targeting failed and that the password-spray campaign’s more than 151,000 logged attempts all failed. The reports do not provide one overall success rate across cases.

What should industrial operators do?

The joint advisory recommends inventorying controllers, applying firmware updates, keeping PLCs off the public internet, restricting network traffic, separating IT and operational technology, requiring multifactor authentication for remote OT access, and monitoring for unusual controller writes.

Does AI make cyberattacks faster in every case?

No universal rate is established by these reports. They describe particular examples of automation and faster analysis; how common those gains are and how much they change overall attack success remain unclear.

Source: ThorstenMeyerAI.com