Threat Pulse 62High
Theory: nation-state crews armed with AI agents are the engine behind the October surge
Severity 3Status unknownreportedGovernmentFinanceAI-related

Microsoft attributes the ConnectWise supply chain compromise and 2,250-tenant campaign to China-aligned Storm-0940 using the ARTEX agent framework; Cyfirma sees a Korean-speaking, Lazarus-like crew preparing PHP2Shell attacks on banks and governments; Bitget blames North Korea for $387 million; Iran's Handala wiped Stryker in March. Proponents say AI agents let state actors run intrusions at machine speed and volume.

What to do: Attribution confirmed for ConnectWise and Bitget; others moderate confidence.

AI angle: ARTEX is model-agnostic; CrowdStrike separately documented state-adjacent operators using Claude Code.

· 15 days ago · China, North Korea and Iran linked operations · Korea JoongAng Daily
SourcesKorea JoongAng DailyFortune (Bitget)
On X
@CyberScoopNewsunverified

argues for

Open on X
@Fawadnkunverified

argues against

Open on X
Why this score

Strongly supported for specific incidents (ConnectWise, Bitget, Stryker) but does not account for PHP2Shell, eMudhra or the supply-chain compromises.

Back to the board

Updated Nov 5, 01:45 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.