AI 导读
微软披露，中国背景组织 Storm-0940 最早于 2026 年 9 月起使用 agentic AI 渗透测试框架 ARTEX 自动化攻击，涉及 2250+ 个 Microsoft 365 租户，登录尝试达每分钟 2900 次，多起案例在不到 3 小时内获得云基础设施特权访问。微软将该组织与近期披露的 ConnectWise 供应链入侵事件关联，称这是首批公开记录的国家行为者以机器速度用 AI Agent 规模化攻击的案例之一。
推荐理由
原文梳理了微软披露的 Storm-0940 用 agentic AI 规模化攻击的细节，读者可据此了解 AI 加速网络攻击的实际进展。
正文
To make this more clear: Microsoft says a China-aligned group used an open-source agent framework to hit 2,250+ Microsoft 365 tenants at 2,900 sign-in attempts a minute after the ConnectWise breach. In some cases it got privileged access in under 3 hours.
This is one of the first publicly documented cases in which a state actor has scaled up attacks using AI agents at machine speed.
Whats happening right now is probably way worse than the Hugging Face incident. AI-powered attacks are hitting real organizations while major platforms disclose breaches and critical flaws. - Microsoft reports AI agents targeting hundreds of organizations, reaching privileged cloud access in under three hours in multiple cases. It attributes the ConnectWise compromise to the same group. - CrowdStrike documented four operators running successful AI-agent campaigns. One compromised at least 15 Argentine healthcare organizations. - PHP2Shell: AI helped turn longstanding PHP flaws into working exploits. Cloudflare’s CEO reports millions of exploitation attempts. Their AI involvement is unknown. - Railway disclosed possible access to customer secrets. LiteLLM shipped a backdoored release. Zeabur confirmed another breach and is shutting down. - GitLab patched a maximum-severity flaw affecting 12 years of releases. Node.js patched a serious code-execution vulnerability, with Vercel deploying firewall protections. Feels like a turningpoint.在 X 查看被引用的帖子
来源：Chubby♨️ · x.com