Threat Intelligence: AI Agents Join Edge-Device Attack Wave

Two Trends, One Pattern

The first two weeks of October 2026 produced a lot of threat intelligence. There were weekly bulletins, a quarterly landscape report, a flagship annual report from Microsoft, and a new national cyber strategy in Singapore. Read side by side, they tell one story that is hard to miss. Attackers are now using AI agents in real operations, and those agents are going through the same entry points defenders have struggled to close for years: exposed edge appliances, leaked or forgotten credentials, and trusted cloud identities. AI is not replacing the usual attack chain. It is making that chain run faster.

That combination is the real development. On their own, AI-assisted attacks could be dismissed as a novelty, and unpatched firewalls as an old problem. Together, they suggest that the time between a known weakness and a working compromise is getting shorter.

AI Moves From Proof of Concept to Casework

Check Point's research bulletins for the weeks of October 5 and October 12 now give AI threats their own section, and the entries look like incident reports, not lab demonstrations. Researchers described JadePuffer, an AI-enabled actor that Microsoft tracks as Storm-3168. It used compromised Azure service principals to automate cloud reconnaissance and then destructive actions, including deleting storage and going after backup assets.11 Black Arrow Cyber's weekly briefing points to Microsoft's own write-up, which calls these "agentic-driven cloud attacks."14

Other cases follow the same pattern. A campaign against South Korean financial institutions using the ARTEX toolkit left exposed directories that contained Claude Code session histories and Chinese-language prompts. Researchers say the attackers used AI-assisted workflows to steal data they planned to sell.12 An AI-augmented initial access broker called CyberXero was profiled targeting Ukrainian energy infrastructure. It reportedly obtained data on more than 628,000 Ukrainians by combining automated exploitation with AI agents.12 Huntress looked into at least 40 incidents tied to a ClickFix campaign in which malicious Custom GPTs on ChatGPT steered victims toward remote access malware.11

The targets are changing as well as the tools. One phishing campaign hid prompt injections inside HTML comments and invisible text. The emails were aimed at the AI email assistants that summarize messages, not just at the people reading them.12 Hendry Adrian's weekly recap reports attackers checking whether stolen AWS keys work for Amazon Bedrock and probing Claude-related tokens for model access and billing value.20 In other words, AI accounts are now loot in their own right. Separately, autonomous agents were seen trying basic SQL injection against the US Department of Education and Library and Archives Canada while collecting public information. Officials reported no compromise, and where the agents came from is still unconfirmed.11

Imperva's weekly summary is the most direct on this point. It says AI agents are cutting the amount of hands-on attacker work needed and creating risk when autonomous systems go beyond their intended limits.15 Its October 5 edition cites a DIVD incident in which an autonomous agent chained two Zammad zero-days on its own to breach a network.18

The Front Door Is Still the Edge

The AI stories get the headlines, but the vulnerability listings show where intrusions actually start. Citrix patched critical NetScaler ADC and Gateway flaws that attackers had already used to plant web shells, steal credentials, and move into internal networks.11 One week later, Citrix confirmed targeted exploitation of another NetScaler bug that affects appliances set up for SAML authentication.12 Help Net Security reporting, collected by Black Arrow, says suspected state-sponsored actors had been exploiting the NetScaler zero-day since early September.14

Cisco's situation is worse. It warned of an actively exploited CVSS 9.8 flaw in Catalyst SD-WAN Manager that gives unauthenticated attackers administrator access, and it said no fix was available.11 Fortinet's FortiMail zero-day, actively exploited SharePoint and MikroTik flaws, and attacks on Zimbra and Roundcube all appear in the same week's coverage.14

The FortiBleed campaign shows the scale involved. The FBI and Secret Service warned of continued exploitation affecting more than 86,000 FortiGate firewalls and VPN gateways in 194 countries. Attackers reportedly used previously stolen credentials to keep access and then sold it to ransomware affiliates, including INC, Lynx, and Payload.12 That is the path from an edge appliance to extortion, with access brokers handling the step in between.

The Warlock ransomware group shows how long an old vulnerability stays useful. Researchers documented it using SharePoint ToolShell flaws to break into utilities, telecom, government, and education organizations, switching off endpoint protection and deploying ransomware to at least 33 hosts in a single intrusion.11 Detectify's data, reported by Black Arrow, explains why this keeps working. Up to 97% of open critical and high-severity flaws in the US, UK, and Nordics had been exposed for more than 90 days. Organizations with exposed AI tools fixed them at less than half the rate of other customers.14

Identity Is the Real Perimeter

The third theme across the coverage is credentials. Imperva highlights more than 543,000 still-valid credentials found in public GitHub repositories, and more than 16,000 misconfigured Supabase databases leaking passwords and authentication tokens.18 Black Arrow describes a campaign that tried likely default passwords on 5,714 Microsoft 365 accounts across 28 tenants and got into seven. All seven were non-personal service accounts, and six fell within seven minutes.14

State espionage actors are going after identity too. TA419, a China-aligned group, has targeted US AI policy experts at think tanks, universities, and law firms. It poses as well-known economists and policymakers, builds rapport with harmless emails, and then sends targets to pages that steal Microsoft 365 credentials and session cookies.11 Russia-linked Star Blizzard has targeted more than 100 organizations, mostly in the US and UK, using a new technique called RedFlick to deliver the CosmicPulse backdoor.11 A campaign against Taiwanese research organizations used phishing infrastructure that could capture credentials and MFA challenges in real time.12

The data breaches of the past fortnight show what happens when that exposure turns into loss. Denmark disclosed that a supplier's access to its Central Register of Persons was abused, exposing records for about 8.8 million people.12 Japan's Times Car reported about 6.6 million affected accounts, with driver's-license images exposed for around 1.6 million of them.11

Where the Reporting Diverges

The sources agree on direction but not on how far things have gone. Ransom-DB counted 271 leak-site publications in one week, up 33.5% from the week before. The Gentlemen led with 41 victims, and US organizations made up 48.3% of the total.8 Those figures measure what ransomware gangs publish, not every attack that happens, and they swing sharply from day to day. They are best read as a sign of operational tempo, not a census of victims.

The AI framing varies more. Some commentary describes AI-driven "carpet bombing" ransomware and a declared Japanese cyberspace emergency in sweeping terms.2 The vendor bulletins are more cautious. They record specific campaigns, unconfirmed origins, and attempts that failed.1112 The better-supported view is the measured one. AI is speeding up reconnaissance, social engineering, and post-compromise actions. But the documented cases still depend on stolen service principals, exposed appliances, and phishing.

There is also a gap between what defenders say they plan to do and what they are actually doing. Flashpoint's enterprise survey finds that nearly half of threat intelligence teams are using or piloting agentic AI, and that AI threats top their priorities for 2027.17 Meanwhile, AWS research cited by Black Arrow found that only 24% of European businesses using AI have a documented approach to responsible use, and just 10% have a data governance strategy.14

Governments Push Defense Upstream

The clearest policy response came from Singapore. Senior Minister K. Shanmugam launched the country's 2026 cybersecurity strategy, which commits to continuous threat hunting in critical infrastructure and AI-assisted national defense. He warned that agentic AI is advancing faster than safeguards can keep up.3 One key measure is a national protective DNS service that blocks connections to known malicious domains before they load. It comes as malware-infected systems detected in Singapore more than doubled, from 117,300 in 2024 to 284,300 in 2025.6 An expert cited by The Straits Times noted that the service is only as good as its threat feeds, and that new scam sites can get through before anyone flags them.6

Microsoft's 2026 Digital Defense Report frames the moment in similar terms. It argues that AI is changing the basic physics of cybersecurity, but defenders still cannot lose sight of the fundamentals.19

The Takeaway

The main lesson from this month's threat intelligence is that AI threats and basic security hygiene are now one problem, not two separate budget lines. Agentic tooling makes an exposed NetScaler, a forgotten service account, or an over-privileged Azure principal more dangerous, because it shrinks the time between finding a weakness and exploiting it. Secarma's October summary puts it simply: organizations need to know what is exposed, who has access, and how quickly they can act.13 The coverage from this period suggests that the third question, speed, is the one that now decides outcomes.