How Companies Can Keep Pace With AI-Driven Cyberattacks

🔍 Read the full analysis: How Companies Can Keep Pace With AI-Driven Cyberattacks on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get smart everyday buys delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

U.S. agencies and Microsoft have described separate cases of attackers using AI tools against industrial control systems and cloud services, adding evidence that automated software is being folded into established cyberattack methods. The reports do not show that most attempts succeeded: Microsoft said the majority of targeting it observed was unsuccessful, and that a successful sign-in alone does not establish that data was accessed.

A joint advisory published August 18 by the NSA, CISA, FBI, Department of Energy and Environmental Protection Agency says actors used AI-generated scripts against internet-reachable Siemens S7 programmable logic controllers, or PLCs. These industrial computers help operate equipment such as pumps, valves and production lines. The advisory says attackers found exposed controllers through internet scanning services and used scripts built on the open-source snap7 library, disguised as legitimate monitoring tools. It names models from the S7-200 through the S7-1500, including safety controllers.

In an October 21 report, Microsoft Threat Intelligence linked China-state-aligned actor Storm-0940 to the use of ARTEX, an open-source agentic penetration-testing framework, in activity involving ConnectWise Cloud Backup. Microsoft said the actor attempted sign-ins to more than 2,250 tenants after obtaining credentials for the cloud backup application. It also recorded more than 151,000 failed sign-ins during a password-spray campaign from October 10 to 14, peaking at 2,900 failures per minute; Microsoft said none of those attempts succeeded.

Microsoft reported that in several attacks, the time from initial targeting to privileged cloud access was under three hours. It cautioned that most targeting was unsuccessful and that an affected application or successful sign-in does not necessarily mean data was accessed. ConnectWise disclosed the compromise on October 16 and said existing backup archives showed no indication of compromise. It suspended Cloud Backup, SaaS Security and Cloud Management while investigating.

Faster Attacks Put Basics Under Pressure

The reports matter because AI tools can help automate familiar stages of an intrusion, including reconnaissance, password attempts and adapting scripts. The evidence presented does not point to an autonomous system that can reliably break into any target. Instead, it shows attackers applying software to routine tasks, potentially increasing the volume and speed of attempts while reducing the skill or time needed for some steps.

That speed can narrow the time available to detect and contain an intrusion. Microsoft’s account of access within three hours illustrates why security teams cannot rely only on periodic reviews or slow manual escalation. Industrial environments face a separate risk: a controller exposed to the internet may be reachable by attackers, with potential consequences for physical operations. The agencies assess the activity as likely preparation to cause operational effects, rather than reporting that such effects occurred.

AI also affects the defensive side. OpenAI said AI helped identify critical PHP vulnerabilities that were patched on October 21 before attackers exploited them, and forecast that AI-discovered critical vulnerabilities will increase sharply in the coming months. That is a company forecast, not a measured future outcome. If more flaws are found, organizations may face added pressure to assess and install fixes promptly.

Two Reports, Different Attack Paths

The government advisory and Microsoft report describe different targets and methods. The first concerns operational technology: industrial controllers that can affect physical processes. The second concerns a software supply-chain route into cloud tenants through an application that customers had already trusted. Neither report supports treating every AI-assisted attempt as a successful breach.

The agencies recommend maintaining an inventory of PLCs, updating firmware and preventing direct internet access. Their guidance also includes blocking TCP port 102 at the perimeter, separating information technology and operational technology networks with a demilitarized zone, and requiring multifactor authentication for remote access to operational systems. They recommend monitoring S7 traffic for writes outside authorized change windows.

For cloud and enterprise systems, Microsoft’s account underscores the exposure that can come with trusted third-party applications and credentials. Companies need to review which applications have access to their environments, what permissions those apps hold and whether their activity is monitored. These steps address well-established security weaknesses; the reports do not suggest that buying a particular AI product is the answer.

“This is not a theoretical risk—it is an active threat.”

— Joint Cybersecurity Advisory from the NSA, CISA, FBI, Department of Energy and EPA

Breach Impact Remains Unclear

The public accounts leave key questions unanswered. Microsoft said a successful sign-in does not necessarily mean data was accessed, and ConnectWise said existing backup archives showed no indication of compromise. The supplied reports do not establish whether customer data was taken, which individual tenants experienced confirmed access, or the full operational impact of the activity involving Siemens controllers.

The agencies assess that the PLC activity may be preparation for operational effects; that is an assessment of intent, not confirmation that equipment was disrupted. The source material also includes a security leader’s prediction of a near-term “vulnerability tsunami” and an estimated 18-month period of pressure. Those are opinions and forecasts, not official findings or measured timelines. The scale and pace of future AI-assisted attacks remain uncertain.

Prioritize Controls and Incident Readiness

Companies should start with steps that reduce existing exposure: maintain accurate hardware and software inventories, set deadlines for patching, require phishing-resistant sign-in where available, and review third-party applications and their permissions. Operators of industrial systems should check that PLCs are not exposed to the public internet, separate operational and corporate networks, and restrict remote access.

Security teams should also practise incident response, including how to revoke compromised credentials, isolate affected systems and assess whether data or operations were affected. Boards can ask for clear reporting on these controls, outstanding risks and response readiness rather than treating AI adoption itself as a security plan. For individuals, securing the email account with strong multifactor authentication is a practical starting point because email can be used to reset access to other services.

Further clarity will depend on updates from the affected companies and agencies, including findings about access, data exposure and any operational consequences. Until then, the reports support preparing for faster attempts while keeping claims about damage and future attack levels qualified.

Key Questions

What did U.S. agencies report about AI and industrial controllers?

The agencies said actors used AI-generated exploitation scripts against internet-reachable Siemens S7 PLCs. They described the activity as active and assessed it as likely preparation for possible operational effects; the advisory does not confirm that operations were disrupted.

Did Microsoft confirm that customer data was stolen?

No. Microsoft said a successful sign-in does not necessarily mean data was accessed. ConnectWise said existing backup archives showed no indication of compromise while it investigated.

What should companies do first?

Start with an accurate inventory, timely patching, phishing-resistant authentication, reviews of third-party app access and practiced incident response. Industrial operators should also keep controllers off the public internet and separate operational technology from corporate networks.

Are AI-driven attacks expected to increase?

OpenAI forecast that AI-discovered critical vulnerabilities will increase sharply in the coming months. That is a forecast, not a confirmed measure of future attack activity. The reports establish that AI tools have been used in specific attack activity, but they do not establish how common or successful such attacks will become.

Source: ThorstenMeyerAI.com