AI攻击潮：微软与CrowdStrike报告揭示AI代理攻击，GitLab满分漏洞与LiteLLM后门同日告急
微软10月21日发布威胁情报报告，将近期的ConnectWise供应链入侵归因于与中国关联的组织Storm-0940。据微软报告，该组织使用开源AI渗透框架ARTEX自动化侦察、大规模密码喷洒与OAuth应用滥用，经ConnectWise应用身份对超过2,250个下游Microsoft 365租户发起登录尝试，峰值达每分钟约2,900次；10月10日至14日的密码喷洒阶段针对8家机构的327个账户、产生超过15.1万次失败登录，未观察到成功登录。在更广泛的攻击活动中，部分案例从开始定向到取得特权云访问用时不到3小时。微软同时提醒，成功登录并不必然意味着客户数据已被读取或窃取。ConnectWise自10月21日起分阶段恢复受影响服务。
网络安全公司CrowdStrike同期发布的报告记录了2026年5月至8月间4名运营者以AI代理发动攻击的活动。其中一名说西班牙语与英语的运营者使用由开源项目PentestGPT改造的双代理框架，攻破至少15家阿根廷医疗机构，并从至少一家机构窃取了凭据与医疗记录；一名说中文的运营者有20多个全球目标，攻破了两个国家的政府机构；另两名运营者分别说印度尼西亚语与俄语。CrowdStrike称，这些活动的特点是AI代理不只生成工具，还在攻击过程中自行决策并执行命令。
同一周，开发工具与AI基础设施接连告急。GitLab10月21日发布修复，修补编号CVE-2026-110264、CVSS评分满分10.0的漏洞：该漏洞源于正则表达式编译时的整数溢出，在特定条件下可让未登录用户在自托管服务器上执行任意代码，影响回溯至2014年7.0版的12年间版本；修复版本为19.5.1、19.4.3、19.3.6、19.2.9、19.1.9、19.0.10与18.11.13，GitLab.com已运行修复版本，GitLab称尚无该漏洞被用于攻击的迹象。
AI模型网关工具LiteLLM的1.107.0版本被植入窃取凭据的恶意代码与后门，该版本10月21日在PyPI上架后于当日13时23分（UTC）被移除，相关Docker镜像亦被下架或重新指向干净版本；维护方建议开源用户固定使用1.106.2或更早的干净版本，企业版私有仓库用户不受影响。云部署平台Zeabur在8月与10月接连发生数据泄露，10月14日至15日的事件中约320万条环境变量记录被读取，该公司已宣布将于12月31日关停服务，12月1日起停止续费并暂停共享集群上的运行服务。
The AI Attack Wave: Microsoft and CrowdStrike Detail Agentic AI Intrusions as a Maximum-Severity GitLab Flaw and a Backdoored LiteLLM Release Land in the Same Week
In a threat-intelligence report published on October 21, Microsoft attributed the recent ConnectWise supply-chain intrusion to Storm-0940, a China-aligned actor. According to Microsoft, the group used ARTEX, an open-source agentic AI penetration-testing framework, to automate reconnaissance, large-scale password spraying and OAuth application abuse, attempting sign-ins to more than 2,250 downstream Microsoft 365 tenants through ConnectWise application identities at rates peaking near 2,900 attempts per minute. A password-spray phase from October 10 to 14 targeted 327 accounts at eight organizations and generated more than 151,000 failed logons, with no successful sign-in observed. Across the wider campaign, some intrusions progressed from initial targeting to privileged cloud access in under three hours. Microsoft also cautioned that a successful sign-in does not by itself establish that customer data was accessed or stolen. ConnectWise began phased restoration of affected services on October 21.
A report from cybersecurity firm CrowdStrike, covering May to August 2026, documented four operators running agentic AI campaigns. A Spanish- and English-speaking operator used a dual-agent harness rebuilt from the open-source PentestGPT project to compromise at least 15 healthcare organizations in Argentina, exfiltrating credentials and medical records from at least one victim. A Chinese-speaking operator had more than 20 named global targets and compromised government entities in two countries. The remaining two operators spoke Indonesian and Russian. CrowdStrike said the campaigns stood out because the AI agents did not merely build tooling; they made decisions and executed commands during the attacks.
Developer tooling and AI infrastructure were hit in the same week. On October 21, GitLab released fixes for CVE-2026-110264, a vulnerability rated 10.0, the maximum CVSS score. Caused by an integer overflow during regular-expression compilation, the flaw could, under certain conditions, let an unauthenticated user execute arbitrary code on self-managed servers, and it reaches back across 12 years of releases to version 7.0 in 2014. The fixed versions are 19.5.1, 19.4.3, 19.3.6, 19.2.9, 19.1.9, 19.0.10 and 18.11.13; GitLab.com already runs the fix, and GitLab reports no sign the flaw has been exploited.
Separately, version 1.107.0 of LiteLLM, an AI model gateway tool, was shipped with a credential stealer and a backdoor. The release was removed from PyPI at 13:23 UTC on October 21, hours after it appeared, and the affected Docker images were removed or repointed to clean builds. The maintainers advise open-source users to pin version 1.106.2 or another pre-incident release; enterprise customers pulling from LiteLLM's private registry were not affected. Cloud deployment platform Zeabur, which suffered breaches in August and again on October 14-15, when about 3.2 million environment-variable records were read, has announced it will shut down by December 31, with renewals disabled and shared-cluster services paused starting December 1.
来源：GSM·美国（原文链接）
图片来源：美国空军第616作战中心。（Wikimedia Commons，Public domain，U.S. Air Force photo by Vincent Childress）The U.S. Air Force 616th Operations Center. (Wikimedia Commons, Public domain, U.S. Air Force photo by Vincent Childress)
