The AI Cyberattack Shift: What Businesses And Individuals Can Do

🔍 Read the full analysis: The AI Cyberattack Shift: What Businesses And Individuals Can Do on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

US agencies and Microsoft have reported documented uses of AI in cyber operations, including scripts targeting industrial controllers and an agentic framework used in attacks involving a cloud backup provider. The reports point to a practical concern for organizations: software can speed up familiar attack steps, while the extent of successful access and data theft remains uncertain.

A joint advisory published August 18 by the NSA, CISA, FBI, Department of Energy and Environmental Protection Agency says actors used AI-generated exploitation scripts against internet-reachable Siemens S7 programmable logic controllers. PLCs are industrial computers used to control equipment and processes. The advisory says the activity involved reconnaissance and capability development, and assessed it as likely preparation for possible operational effects against critical infrastructure.

Microsoft Threat Intelligence reported October 21 that the actor it calls Storm-0940 used the open-source ARTEX agentic penetration-testing framework in activity linked to a ConnectWise Cloud Backup compromise. Microsoft said the actor attempted sign-ins across more than 2,250 customer tenants using credentials associated with the app. It recorded more than 151,000 failed logons in a password-spraying campaign from October 10 to 14, with a peak of 2,900 failures per minute; Microsoft said none of those attempts succeeded.

Microsoft said that in several attacks, the time from initial targeting to privileged cloud access was under three hours. It also cautioned that most targeting was unsuccessful and that an affected app or successful sign-in does not by itself establish that data was accessed. ConnectWise said existing backup archives showed no indication of compromise and said it suspended Cloud Backup, SaaS Security and Cloud Management while investigating.

Faster Attacks Raise Response Pressure

The reports suggest that automation can compress the time available to detect and contain an intrusion. Microsoft described a campaign with rapid attempts across many tenants; the agencies’ advisory described AI-generated scripts aimed at industrial equipment. Neither account establishes that AI makes every attack successful, but faster reconnaissance and repeated attempts can increase the pressure on teams responsible for access controls, monitoring and response.

That pressure affects organizations of different sizes. A business with limited security staff may have less time to identify unusual sign-ins or revoke a compromised app’s access. For industrial operators, an exposed controller can pose risks beyond information systems because it is connected to physical processes. The agencies’ recommended protections focus on reducing exposure and limiting the paths from corporate IT networks to operational technology.

AI also appears on the defensive side. OpenAI said AI-assisted work identified critical PHP vulnerabilities that were patched October 21 before attackers exploited them, and predicted that discoveries of this kind would increase sharply in the coming months. That is the company’s forecast, not a measured estimate of future attack volume. More vulnerability findings could still mean more work for defenders to verify and patch software promptly.

What the Reports Document

The current reports describe ordinary cyberattack techniques assisted by automation, rather than a wholly new category of attack. The government advisory says actors found exposed Siemens controllers through internet-scanning services and used scripts built with the open-source snap7 library, disguised as monitoring tools. It names manufacturing, energy, water, chemical, food and agriculture, and commercial facilities among the sectors of concern.

Microsoft’s account concerns a different route: access associated with a trusted third-party cloud backup app. The company said Storm-0940 has been active since 2021 and assessed it as China-state aligned. ConnectWise disclosed the compromise on October 16. Those are source characterizations and reported timelines; the available material does not independently establish the actor’s identity or the full scope of any customer impact.

Other claims need similar care. A security leader’s prediction, cited in the source material, of a coming “vulnerability tsunami” and roughly 18 months of worsening conditions is an expert opinion, not a measured forecast. The reports support concern about the speed and scale of particular operations, not a blanket conclusion that all attacks are AI-driven or that defenses are failing.

“The majority of the targeting wasn’t successful.”

— Microsoft Threat Intelligence

Scope and Outcomes Still Unclear

The reports do not establish how many organizations suffered confirmed data access or operational disruption. Microsoft said an affected app or successful sign-in does not necessarily mean data was accessed, while ConnectWise said it had found no indication of compromise in existing backup archives. The investigations’ full findings and customer impact were not provided in the source material.

The agencies described activity against Siemens S7 controllers and assessed that it was likely preparation for operational effects. That assessment does not confirm that disruption occurred. Details about the actors’ identities, their ultimate intent and the extent to which AI was used in each phase are also limited. Predictions about a rapid rise in vulnerability discoveries or attacks remain forecasts, not established outcomes.

Patch, Restrict, and Monitor

The agencies advised operators to inventory controllers, patch firmware, keep PLCs off the public internet and block TCP port 102 at network perimeters. They also recommended separating IT and operational technology networks, requiring multifactor authentication for remote OT access, and monitoring S7 traffic for writes outside approved change windows. These steps address the exposed systems and access routes described in the advisory.

For businesses generally, the reports point to a short list of practical controls: maintain an accurate inventory, set patch deadlines, use phishing-resistant sign-in where available, review third-party applications and their permissions, and practise incident response. Organizations should also know how to revoke an app’s access and investigate unusual sign-in activity. Individuals can start by securing their email account, which may be used to reset passwords or access other services.

Further updates should clarify the investigations’ scope and whether additional organizations or systems were affected. Companies should follow advisories from relevant government agencies, Microsoft and ConnectWise, and verify claims against published findings rather than treating forecasts as confirmed incident data.

Key Questions

What has been confirmed about AI use in these attacks?

The joint US agency advisory says actors used AI-generated scripts against internet-reachable Siemens S7 controllers. Microsoft says Storm-0940 used the ARTEX framework in activity connected to a cloud backup app compromise. These are reports about specific operations, not evidence that every cyberattack now uses AI.

Did the Microsoft-reported campaign access customer data?

The available reporting does not establish the full extent of data access. Microsoft said an affected app or a successful sign-in does not necessarily indicate that data was accessed. ConnectWise said existing backup archives showed no indication of compromise while it investigated.

What should an industrial operator do first?

Follow the joint advisory’s basic protections: identify controllers, patch firmware, prevent direct internet access, restrict remote access with multifactor authentication, separate OT from IT networks and monitor for unusual control-system traffic.

What can an individual do now?

Secure your email account with a strong, unique password and phishing-resistant multifactor authentication where available. Review recovery options and active sessions, and be cautious of unexpected sign-in prompts or messages asking you to approve access.

Source: ThorstenMeyerAI.com