AI Attack Agents and the ConnectWise Breach Reset the SOC Clock

Week of 26 October 2026 | Compiled by Team Paringa

This week the question for SOC and MSSP leaders moved from "will attackers use AI" to "how much of the attack chain is already automated". Detection windows are shrinking from days to hours.

What Happened This Week

🔴 Microsoft: AI agents and a ConnectWise breach put 2,250+ cloud tenants in the crosshairs

Microsoft disclosed on 21 October that Storm-0940, a China-linked espionage group active since at least 2021, used ARTEX, an open-source Go-based AI penetration-testing framework, to automate reconnaissance, vulnerability discovery, credential attacks and data theft against Microsoft 365 environments. Targets reportedly span government agencies, defence contractors, banks, manufacturers and technology firms.

The campaign began with password spraying: more than 151,000 failed sign-ins against 327 accounts at eight organisations between 10 and 14 October, with no successful logins. The group then pivoted to compromised ConnectWise application identities, which let it ride permissions customers had already granted ConnectWise services, with no interactive login needed. It attempted authentication against more than 2,250 tenants, at times around 2,900 attempts per minute, and in some cases went from target selection to privileged cloud access in under three hours.

ConnectWise switched off its Cloud Backup, SaaS Security and Cloud Management services, and CEO Manny Rivelo said the affected connections were contained and services are being restored gradually. He also acknowledged that cutting the connections does not evict attackers who already have a foothold inside customer environments. Microsoft has not said how many customers were compromised or whether data was taken.

The implication for MSSPs is uncomfortable. The trusted tooling you use to manage customers is itself the attack path, and AI compresses the time between first touch and privileged access to less than a typical SOC shift handover.

Sources: The Register

If you run or buy managed security, ask one question this week: who monitors the application identities and RMM integrations that hold standing permissions in your cloud tenants? Most SOC use cases watch users, not service principals. Audit third-party app consents, alert on credential changes to application identities, and test whether your MSSP can detect and contain privileged access inside a three-hour window. This is a concrete gap to raise with every managed-service customer before the end of the quarter.

🔴 Symantec uncovers an autonomous attack agent with a "Skynet mode"

Symantec's Threat Hunter Team trapped an attack agent in an AI honeypot over the summer and recovered its full instruction set, reported by The Register on 24 October. The agent scans the internet for endpoints that accept OpenAI-style requests without authentication or with a stolen key, then hijacks the model behind them to plan its attacks. Its operators named the loop "Skynet mode": scan, infect, deploy cryptocurrency miners, reinfect.

The agent carries 74 offensive tool definitions, including internet-wide asset discovery, botnet command and control, database dumping through Prisma, and remote code execution modules for VS Code, Django, Jupyter, Laravel, Supabase, Next.js and Flask. It was authorised to run for up to 100,000 steps without human approval. Symantec's Priti More stressed that nothing in the individual techniques is new; the novelty is wiring them into one agent that borrows another party's model as its reasoning engine. Symantec has found no evidence of use in real attacks yet, but says the kit is "more than a prototype".

There are two victims in every incident: the owner of the exposed endpoint, who pays for the inference, and any server the agent breaches. Attribution is unclear; French language clues are weak indicators.

Sources: The Register

Treat every unauthenticated AI gateway, proxy or inference endpoint in your estate as internet-facing attack surface and as a billing risk. Add AI endpoints to asset discovery, require authentication and rate limits, and give threat intelligence teams a detection use case for agent-style traffic: high-volume, tool-driven and unattended. For MSSPs, this is a productisable service: an AI exposure assessment sold as a quick-win entry point into larger SOC engagements.

🟡 PHP2Shell: exploitation started four days before the patch

Two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, both rated 9.2, let unauthenticated attackers run code on servers regardless of the CMS on top. Amazon Threat Intelligence detected an exploitation attempt on 17 October, four days before patches landed on 21 October, which its MadPot honeypots caught while the flaw was still under embargo. Cloudflare reported thousands of attempts in the 10 hours before disclosure, rising to millions afterwards, with attackers adapting payloads to evade its WAF using feedback from blocked requests.

The fallout is wide. Ministers said dozens of UK government services were disrupted, though no breach is confirmed. A third PHP2Shell bug has also been found and will not get an emergency fix. The PHP Foundation also accused Chainguard of publishing patched builds before the agreed deadline, adding disclosure-process friction to the patching race.

Sources: The Register, The Register

Patch-after-disclosure is no longer a viable posture for internet-facing PHP. Hunt for suspicious activity back to at least 17 October, not 21 October, and keep a WAF as a stopgap only. Pitch this as the clearest recent proof point for continuous threat hunting and exposure management.

🟡 SafePay ransomware: roughly 600 victims, and a joint advisory

CISA, the FBI, the US Secret Service and international partners issued an advisory on 22 October saying SafePay, one of 2026's most active ransomware groups, has compromised about 600 organisations across critical infrastructure sectors in the Americas, Europe and Australia. Initial access comes from stolen, exposed or guessed credentials, VPN abuse and known vulnerabilities in internet-facing devices. Post-compromise, actors create new accounts, disable security software, halt backup services and reset network storage holding backups before demanding a share of revenue.

Related reporting from The Register this week shows Qilin and Inc ransomware crews exploiting a Palo Alto PAN-OS GlobalProtect authentication bypass (CVE-2026-0257) since June, in one case pivoting through vCenter to dump domain controller credentials from a virtual disk, which evades in-guest EDR.

Sources: Industrial Cyber, The Register

The common thread is that attackers are going around endpoint tooling, via the VPN edge and the hypervisor. Extend monitoring to hypervisor and management-plane logs, and validate that backups are immutable and offline. This is a strong, evidence-backed basis for a resilience review conversation with critical infrastructure customers.

What Security Leaders Are Dealing With

The week's stories share one pattern: automation on the attacker side is outpacing human-speed operations on the defender side. AI agents drove Storm-0940 from target to privileged access in hours, PHP2Shell was exploited before the patch existed, and an unattended 100,000-step attack agent is now documented in the wild. Meanwhile attackers keep choosing trusted paths, such as an RMM vendor's application identities or a VPN gateway, over noisy malware.

For SOC and MSSP leaders this changes the buying criteria. Mean time to detect measured in days no longer matches the threat. Buyers will increasingly ask for machine-speed triage, identity and third-party-app visibility, and threat intelligence that arrives before the patch does.

Three Things Worth Watching Next Week

1. ConnectWise fallout - Watch for Microsoft or ConnectWise disclosing how many customers were actually compromised, and for other RMM and backup vendors reviewing their own application identities.

2. PHP2Shell exploit paths - Hadrian expects more exploit routes beyond the session upload-progress path, and the third bug remains without an emergency fix.

3. First confirmed in-the-wild use of AI attack agents - Symantec has seen no real attacks yet; the first confirmed victim will turn this from a research story into a board-level one.

Questions? hello@paringa.ai

Paringa connects security leaders with vCyberiz-class capabilities that fit the way modern attacks actually work: fast, automated and identity-centric. We help you turn weekly threat news into a funded, prioritised plan. | 26 October 2026 | © Paringa Ltd