AI attacks this week: State-aligned group uses AI agents to attack through ConnectWise (week 43/2026)

Reporting period: 19 to 25 October 2026.

ConnectWise: State-aligned group automates a supply chain attack with AI agents

On 21 October Microsoft published a report stating that the group Storm-0940 has been using the open-source tool ARTEX since September at the latest. Microsoft describes Storm-0940 as a China-state aligned actor. In ARTEX, AI agents run a penetration test from reconnaissance through data exfiltration with little human involvement. CrowdStrike had found the same tool in attacks on South Korean financial companies, which we reported on in week 41.

Microsoft also attributes the attack on ConnectWise Cloud Backup (formerly SkyKick) to Storm-0940. On 16 October ConnectWise had reported attempts at unauthorised access and later confirmed unauthorised access to the application's credentials. Using the identities of the compromised applications, the attacker then attempted to sign in to more than 2,250 Microsoft 365 tenants, according to Microsoft. No user sign-in was needed, because the applications already had access in the customers' tenants. In some environments the agents went on to explore the directory, change application credentials and make changes involving privileged roles. In several cases in the campaign, according to Microsoft, less than three hours passed between initial targeting and privileged access to the cloud. Most attempts failed.

On 21 October ConnectWise wrote, drawing partly on threat intelligence from Microsoft, that a China-state aligned group using an openly available agentic AI framework appeared to be responsible. Its own containment, it said, does not remove access that may already have been established in customers' tenants.

Wiz Research observed the same infrastructure in October in attacks on other software vendors.

Role of AI: According to Microsoft, ARTEX accelerated reconnaissance, password spraying and the abuse of the applications to "machine speed". The techniques themselves were already part of Storm-0940's repertoire.

How well established: ConnectWise confirms the unauthorised access itself; Microsoft describes the follow-on activity at customers from its own telemetry. The report does not disclose how Microsoft identified the use of ARTEX, and ConnectWise relies on Microsoft for the AI statement. Whether customer data was exfiltrated is open. ConnectWise is still investigating how the attacker obtained the credentials.

The hunt for AI keys: Railway, LiteLLM and Andromeda

Railway and LiteLLM reported breaches that, by their own account, were about keys for AI services. Andromeda, a provider of AI infrastructure, reported a similar incident. None of them names a common attacker.

The cloud platform Railway reported a breach on 21 October. A day later it wrote that the attacker had been trying to obtain AI provider API keys for distillation attacks. In such attacks, the outputs of other models are used to train a model of one's own. Environment variables of at most 1.85 percent of all workspaces, about 100,000, may have been exposed. Railway sees the incident as part of a series of attacks on platform companies.

At the AI gateway LiteLLM, a malicious version 1.107.0 that stole credentials was live on PyPI for about two hours on 21 October. LiteLLM has since traced the entry point: on 27 May the master key of an internal agent platform ended up in a public repository. The mistake was noticed, but that key was never revoked. On 10 October the attacker used it and obtained the GitHub token of an owner of the GitHub organisation. On other systems, according to LiteLLM, the attacker looked mainly for inference API keys. India's cyber security agency CERT-In has issued an advisory on the incident.

Andromeda reported unauthorised access to credentials on 20 October, in its assessment as part of an industry-wide attack. It does not say what kind of keys were involved.

Role of AI: AI services were the target and the prize. Railway also suspects that the attacker used models without safeguards, but has not provided evidence.

How well established: All three incidents are confirmed by the affected companies themselves, LiteLLM with a full root cause analysis. No source shows that the cases are connected. LiteLLM corrected its own first assumption on 23 October, that the tokens came from logs into which Claude Code had written them.

Criminals let AI agents run intrusions

From early October the security company NorForge found about two dozen exposed instances of Cairn, an open-source platform for AI agents, being used for attacks. According to Reuters, the agents of one Chinese-speaking actor attempted to break into more than 1,200 sites and got into the websites of more than 100 companies. A successful intrusion typically took around 23 hours. Reuters identified the victims independently. Deere sees no indication that sensitive information was accessed; at SharkNinja a website with product support information was affected. NorForge was able to look directly at the agents' control panels. Reuters could not establish whether data was exfiltrated.

CrowdStrike describes four previously unreported actors whose agent frameworks were exposed in open directories. One compromised at least 15 healthcare organisations in Argentina. Another, with little security knowledge, used Claude Code to get into several Indonesian government domains, but repeatedly had to intervene to overcome the model's safeguards. SOCRadar describes affiliates of the ransomware groups INC and The Gentlemen who ran their intrusions through the coding tool OpenCode. The human set targets and approved; the AI planned and generated the commands. When a model refused, the operator presented the request as an authorised red team assignment.

Role of AI: CrowdStrike considers it likely that low-skill actors will use agentic AI to run campaigns as effective as those of organised criminal groups or state-nexus actors.

How well established: technical reports with artefacts from the attackers' exposed systems. In the Cairn case two companies confirmed the incident to Reuters; for CrowdStrike and SOCRadar there is no confirmation from victims. Some of SOCRadar's information comes from the attackers' own records, which have not been independently verified.

Netherlands: arrests after bank fraud using AI voice messages

On 21 October the Dutch police announced the arrest of two men aged 23 and 25. Victims received calls with recorded messages that the fraudsters had generated with AI in dozens of variants. A supposed bank employee then came on the line and followed a fixed script. Victims were told to install an app and hold their bank card against the phone. The app relayed the chip data to an accomplice waiting at a cash machine at the same time. In the three weeks in which investigators could see the servers, they counted about 170 victims and 380,000 euros in losses.

How well established: police announcement. A court in Rotterdam extended detention by at least 90 days. The suspects are presumed innocent.

Flaws in AI tools

• MCP Inspector (GHSA-4fc4-wcmh-4g86, GHSA-6x67-4w4w-9f3w, GHSA-q978-78c7-phqw): through the MCP project's official testing tool, a malicious MCP server could execute commands on the user's machine. Two of the flaws are rated critical. Fixed in 1.0.3 and, for version 2.x on Windows and WSL, in 2.12.0.
• OpenCode on Windows and WSL: according to Pillar Security, a malicious MCP server could execute code during sign-in. The vendor fixed this in version 1.18.33 but published neither a security advisory nor a CVE. Common vulnerability scanners therefore do not flag affected installations.
• Instruction file in the Downloads folder: Forever Security found a malicious AGENTS.md in the Downloads folder of a customer's machine. A coding agent then tried to install a known malicious package and was stopped before any code ran. How the file got there is unknown.

How well established: MCP Inspector confirmed by the maintainers; OpenCode and the AGENTS.md so far only according to the researchers who found them. The publications contain no information about exploitation.

What follows, in our view

• Review third-party applications in Microsoft 365. Storm-0940 got in through applications that customers had already granted access. Microsoft recommends giving such applications only the permissions they need and monitoring new credentials and roles. According to Microsoft, such changes can remain as a backdoor even after the original application has been remediated.
• Revoke exposed keys immediately. At LiteLLM a known leak stayed valid for four and a half months. A leak is only dealt with once the key is revoked.
• Rotate stored keys. Anyone who stored environment variables on Railway or installed LiteLLM without a pinned version during the affected window should follow the providers' guidance.
• Update MCP tools and connect to third-party servers deliberately. Start coding agents in the project folder: the Downloads folder may contain someone else's instruction file.

Selection and sources

We include reports in which AI was essential to the attack, as a tool, as a target or for deception. Every statement has been checked against the primary source. We distinguish whether an incident has been confirmed by the victim, an authority or the vendor, or has so far only been reported. We welcome reports of errors and make corrections visible.