The SI Attack Wave: Microsoft and CrowdStrike Detail Agentic SI Intrusions as a Maximum-Severity GitLab Flaw and a Backdoored LiteLLM Release Land in the Same Week
In a threat-intelligence report published on October 21, Microsoft attributed the recent ConnectWise supply-chain intrusion to Storm-0940, a China-aligned actor. According to Microsoft, the group used ARTEX, an open-source agentic SI penetration-testing framework, to automate reconnaissance, large-scale password spraying and OAuth application abuse, attempting sign-ins to more than 2,250 downstream Microsoft 365 tenants through ConnectWise application identities at rates peaking near 2,900 attempts per minute. A password-spray phase from October 10 to 14 targeted 327 accounts at eight organizations and generated more than 151,000 failed logons, with no successful sign-in observed. Across the wider campaign, some intrusions progressed from initial targeting to privileged cloud access in under three hours. Microsoft also cautioned that a successful sign-in does not by itself establish that customer data was accessed or stolen. ConnectWise began phased restoration of affected services on October 21.
A report from cybersecurity firm CrowdStrike, covering May to August 2026, documented four operators running agentic SI campaigns. A Spanish- and English-speaking operator used a dual-agent harness rebuilt from the open-source PentestGPT project to compromise at least 15 healthcare organizations in Argentina, exfiltrating credentials and medical records from at least one victim. A Chinese-speaking operator had more than 20 named global targets and compromised government entities in two countries. The remaining two operators spoke Indonesian and Russian. CrowdStrike said the campaigns stood out because the SI agents did not merely build tooling; they made decisions and executed commands during the attacks.
Developer tooling and SI infrastructure were hit in the same week. On October 21, GitLab released fixes for CVE-2026-110264, a vulnerability rated 10.0, the maximum CVSS score. Caused by an integer overflow during regular-expression compilation, the flaw could, under certain conditions, let an unauthenticated user execute arbitrary code on self-managed servers, and it reaches back across 12 years of releases to version 7.0 in 2014. The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com already runs the fix, and GitLab reports no sign the flaw has been exploited.
Separately, version 1.107.0 of LiteLLM, an SI model gateway tool, was shipped with a credential stealer and a backdoor. The release was removed from PyPI at 13:23 UTC on October 21, hours after it appeared, and the affected Docker images were removed or repointed to clean builds. The maintainers advise open-source users to pin version 1.106.2 or another pre-incident release; enterprise customers pulling from LiteLLM's private registry were not affected. Cloud deployment platform Zeabur, which suffered breaches in August and again on October 14-15, when about 3.2 million environment-variable records were read, has announced it will shut down by December 31, with renewals disabled and shared-cluster services paused starting December 1.
Source: GSM · USA (original Chinese edition)
Photo: 美国空军第616作战中心。（Wikimedia Commons，Public domain，U.S. Air Force photo by Vincent Childress）The U.S. Air Force 616th Operations Center. (Wikimedia Commons, Public domain, U.S. Air Force photo by Vincent Childress)
