A ransomware crew spent more than $385 on AI models for each organization named in its records, SOCRadar found. Microsoft and Wiz separately documented October intrusions in which agents did much of the hands-on work, and exploit attempts against a leaked PHP flaw arrived within hours of the news getting out.
Microsoft’s 2,250 Tenants Were Sign-In Targets
Microsoft assessed that Storm-0940, a China-state-aligned group, was responsible for the ConnectWise Cloud Backup compromise, according to its October 21 report. The group used ARTEX, an agentic penetration-testing framework, to attempt sign-ins to more than 2,250 Microsoft 365 tenants at 2,900 attempts per minute. In several cases, Microsoft said, the time from first targeting an organization to privileged cloud access was under three hours.
The 2,250 figure counts attempts. Microsoft did not say how many customers were compromised, CyberScoop reported, and a successful sign-in does not necessarily mean the attackers accessed or stole data. Huntress had confirmed unauthorized sign-ins at 173 tenants by October 17, the day ConnectWise shut down Cloud Backup access.
Microsoft’s timeline shows which tactic worked. Password spraying between October 10 and 14 produced more than 151,000 failed logons across 327 accounts at eight organizations, with no successful authentication. On October 15, the agents began signing in through stolen ConnectWise application credentials, which let them use access customers had already granted to a trusted app, with no user sign-in required.
SOCRadar’s Records Put a Price on Each Target
SOCRadar found the crew’s tooling on exposed servers in late September. Affiliates linked to the INC and The Gentlemen ransomware brands ran intrusions through OpenCode, an open-source coding agent, with commercial models rented through OpenRouter. The researchers analyzed 8,257 messages across 133 sessions and described an “AI-executed, human-approved” structure: the agent planned reconnaissance, generated commands and triaged stolen data, then waited for the operator’s approval before each step. The models were standard commercial ones, and when they refused a request, the operator reworded it as an authorized red-team assessment instead of switching tools.
SOCRadar recorded more than $23,920 in AI spending and found 62 named organizations in the crew’s files. They sat at different depths: four appeared on public extortion listings, four were at the encryption or extortion stage, 14 had domain-level compromise, 28 had a foothold and 12 were reconnaissance only. Spread across all 62, the recorded spend comes to more than $385 each. Counting only the 50 where operators held a foothold or better, it comes to more than $478 each.
The entry points were ordinary: flaws in FortiClient EMS, SimpleHelp and cPanel, according to the operators’ own records, which SOCRadar has not independently verified. Reused credentials multiplied that access faster than anything else, SOCRadar found, and in one case a single reused password unlocked the VPN, servers, remote management, backup and security platforms at once.
Wiz Watched One Agent Work About 25 Targets at Once
Wiz published three intrusions it investigated itself, against an exposed Flowise server, a Java operations gateway and an AI-agent backend with an MCP interface. In the third, Wiz counted more than 150 distinct scripts over about 21 hours aimed at roughly 25 target organizations in parallel, among them major crypto exchanges and fintechs. A new purpose-built script landed every one to two minutes, with none of the gaps a human operator needs. Wiz’s post does not say how many of those organizations were breached.
Wiz argues that skilled human hours used to cap offensive operations and that one operator can now oversee more campaigns against more targets. It also finds the agents loud: they probe many paths at once and leave a broad trail of activity.
PHP2Shell Shows How Short the Window Has Become
AI tools helped researchers find the PHP flaws now called PHP2Shell. Calif found the first issue on August 1 using an OpenAI model, and Wiz independently found the flaws later that month. Details leaked late on October 20, ahead of the planned release, and PHP shipped emergency patches on October 21. Cloudflare counted tens of thousands of exploit attempts within 45 minutes of the news getting out and millions by the evening of October 21, Fortune reported, citing a post by chief executive Matthew Prince. Amazon’s honeypot network had already recorded an attempt on October 17, four days before the patches, and Amazon told defenders not to treat the disclosure date as the earliest date of exploitation.
Attempts are not compromises, though. Wiz reported on October 27 that none of the attempts in its own telemetry had succeeded, and that turning public proofs of concept into reliable tooling across different PHP builds and server setups takes real work. Perplexity researcher Adel Karimi recorded what appears to be the first successful in-the-wild code execution on October 24, against his honeypots. The US Cybersecurity and Infrastructure Security Agency (CISA) added both flaws to its Known Exploited Vulnerabilities catalog on October 26 and gave US federal civilian agencies until October 29 to patch. SecurityWeek has since reported only a few confirmed compromises, among them Palo Alto Networks firewalls rooted by a China-linked actor.
Evidence on the attacker side is thinner. Palo Alto Networks’ Unit 42 first reported an intruder at a European government entity who reached password hashes and multi-factor authentication secrets within two hours, with command output wrapped in delimiters an AI model can parse. Unit 42 later withdrew its assessment that the intrusion involved PHP2Shell, saying it could not confirm the initial access.
What Operators Should Take From October
The data suggests the largest change is cost. Microsoft described actors folding agentic AI into existing offensive workflows, and SOCRadar’s crew entered through known edge-device flaws and reused passwords. The same record shows who sits inside the wider net: of the 35 targets SOCRadar could classify by revenue, 27 earned $250 million or less, and SOCRadar found small businesses reached through a managed service provider.
The implication is practical. A trusted credential did what 151,000 failed password guesses could not, so standing access an agent can borrow, such as unused third-party app grants, shared credentials and reused passwords, deserves the same urgency as an unpatched server. A fix that takes a week also arrives long after the first attempts: Wiz’s telemetry put the share of initially affected organizations still vulnerable one week after PHP2Shell’s disclosure at less than 53%, and Cloudflare was counting millions of attempts within a day.
The reports share one advantage for defenders: agent activity is loud. Wiz lists seven fingerprints, from machine-paced script cadence to scripts that explain themselves in plain language, that teams can hunt for in their own logs.
SOCRadar found its crew because the operators left their AI session logs and knowledge base on an open server, and the researchers called that dependence on AI memory the operation’s weakness. Agent-driven intrusions tend to leave a broad trail. Teams that build detection around it now will see the next campaign sooner.
The post Agents on the Attack Side: AI-Driven Intrusions Move From Research Demo to Incident Report appeared first on DataFLOQ.
