How To Protect Against Faster Cyberattacks Fueled By AI

🔍 Read the full analysis: How To Protect Against Faster Cyberattacks Fueled By AI on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the little things that make your day delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

US agencies and Microsoft have reported attackers using AI-generated scripts and an automated agent framework in campaigns targeting industrial controllers and cloud services. The reports do not show that AI makes attacks inevitably successful, but they describe how automation can speed reconnaissance and repeated attempts—putting pressure on organizations to maintain basic protections and respond quickly.

A joint advisory published August 18 by the NSA, CISA, FBI, Department of Energy and Environmental Protection Agency says threat actors have used AI-generated exploitation scripts against internet-reachable Siemens S7 programmable logic controllers, or PLCs. These industrial computers help operate equipment such as pumps, valves and production lines. The agencies describe activity involving multiple S7 models and warn that the targeted sectors include manufacturing, energy, water, chemicals, food and agriculture, and commercial facilities.

According to the advisory, actors identify exposed controllers through internet-scanning services and use scripts based on the open-source snap7 library, disguised as monitoring tools. The agencies assess the activity as likely preparation for operational effects against critical infrastructure. That assessment describes a potential intent; the advisory does not establish that the reported activity caused operational damage.

In an October 21 report, Microsoft Threat Intelligence said the China-state-aligned actor it calls Storm-0940 used ARTEX, an open-source, multi-agent penetration-testing framework, in activity connected to the ConnectWise Cloud Backup compromise. Microsoft says the actor attempted sign-ins to more than 2,250 tenants using credentials obtained from the cloud backup application. It recorded more than 151,000 failed logons during a password-spraying campaign from October 10 to 14, peaking at 2,900 failures per minute; Microsoft said none of those attempts succeeded. In several attacks, the time from initial targeting to privileged cloud access was under three hours.

Microsoft cautioned that most targeting attempts were unsuccessful and that an affected application or successful sign-in does not by itself show that data was accessed. ConnectWise, which disclosed the compromise on October 16, said existing backup archives showed no indication of compromise. The company suspended Cloud Backup, SaaS Security and Cloud Management while it investigated.

Automation Raises the Cost of Delay

The reports matter because they describe familiar attack steps being carried out at greater speed and scale. Automated scanning, password spraying and attempts to exploit public-facing systems can reduce the time defenders have to spot unusual activity. In the Microsoft cases, some attacks reached privileged cloud access in under three hours, while the large number of failed sign-ins shows that automation can also generate activity without achieving access.

For industrial operators, the stakes include the availability and safety of physical processes, not just exposure of business data. A controller reachable from the internet may offer an entry point into operational technology environments. The agencies’ advice focuses on reducing that exposure and watching for suspicious commands, rather than assuming an AI product will solve the problem.

AI can also assist defenders. The supplied source says OpenAI reported that AI helped identify critical PHP vulnerabilities patched on October 21 and forecast that AI-discovered critical vulnerabilities would “increase sharply in the coming months.” That is a prediction, not a measured future outcome. If vulnerability discovery accelerates, organizations may face more pressure to assess and apply patches promptly. The source does not provide enough detail to quantify how many vulnerabilities will be found or how quickly attackers might exploit them.

What the Reports Actually Describe

The documented pattern is not an autonomous system inventing an entirely new kind of attack. It is software assisting with known tasks, including reconnaissance, password attempts and adapting or running scripts. Microsoft describes ARTEX as capable of operating across stages from reconnaissance to data exfiltration with limited human interaction. That describes the framework’s capabilities; it does not establish that every stage succeeded in the reported incidents.

The industrial-control advisory and the Microsoft account concern different targets and activity. The first describes scripts aimed at Siemens PLCs and a risk to critical infrastructure. The second describes a campaign involving a trusted cloud backup application and tenant sign-ins. They should not be treated as evidence of one coordinated operation. In both, the practical concern is that attackers can use automation to make more attempts, while defenders still need to verify access, contain incidents and protect systems.

The supplied material also refers to a July 30 Unit 42 report about an actor using a language model within the Hermes Agent framework and controlling it through Telegram. The excerpt ends before giving the full incident details or outcome, so it cannot support a more specific account here. A security leader’s forecast in the source of a “vulnerability tsunami” within months and roughly 18 months to hold on is an individual opinion, not a measured forecast or established timeline.

“The majority of the targeting wasn’t successful.”

— Microsoft Threat Intelligence

What Success and Impact Remain Unclear

The reports do not establish that the PLC activity caused physical disruption, or that every organization targeted in the Microsoft campaign suffered a breach. Microsoft says most targeting was unsuccessful and warns that a successful sign-in does not necessarily mean data was accessed. ConnectWise said its existing backup archives showed no indication of compromise, but it suspended three services while investigating.

The supplied material does not give a final investigation outcome, a complete account of affected customers, or evidence that the reported activity caused lasting damage. It also does not establish how often AI assistance was decisive compared with conventional tools or human work. The Unit 42 example is incomplete in the provided source, and forecasts about a surge in vulnerabilities remain predictions rather than confirmed events.

Controls and Investigations to Watch

Organizations using affected ConnectWise services will need to follow the company’s investigation updates and assess whether their accounts, credentials or integrations require action. The supplied source does not specify a resolution date or say when the suspended services would return. Industrial operators should review the joint advisory and check whether PLCs are exposed, firmware is current, remote access is protected and network monitoring can identify unusual controller activity.

For companies generally, the recommended next steps are practical: maintain an inventory of systems and third-party applications; set deadlines for applying security fixes; use phishing-resistant sign-in where possible; review permissions granted to connected apps; and rehearse incident response. Operators should separate information technology from operational technology, restrict remote access and monitor controller traffic. Individuals can start by securing their primary email account with multifactor authentication, a unique password and recovery details they control.

Further reporting should clarify the outcomes of the ConnectWise investigation, whether affected customers experienced data access, and whether agencies report operational effects from the PLC activity. OpenAI’s forecast may be tested against future vulnerability disclosures and patching data, but the supplied source gives no timeline or baseline for measuring that change.

Key Questions

Have AI-driven attacks been confirmed?

US agencies say attackers used AI-generated scripts against Siemens PLCs, and Microsoft reports Storm-0940 used the ARTEX agent framework in activity targeting cloud tenants. These reports document AI-assisted activity, not that every attempted attack succeeded.

Did the reported attacks cause outages or confirmed data theft?

The supplied reports do not confirm operational disruption from the PLC activity. Microsoft says most targeting was unsuccessful and that a successful sign-in does not necessarily mean data was accessed. ConnectWise said existing backup archives showed no indication of compromise while its investigation continued.

What should industrial operators do first?

Check whether PLCs are reachable from the internet, inventory controllers, update firmware and restrict remote access. The joint advisory also recommends separating IT and operational technology networks, blocking TCP port 102 at the perimeter and monitoring S7 traffic for writes outside approved change windows.

What is the most useful first step for an individual?

Secure the email account used to reset passwords for other services. Use a unique password, enable multifactor authentication—preferably a phishing-resistant option—and confirm that account recovery details are current and controlled by you.

Source: ThorstenMeyerAI.com