The China-linked threat group has used the “Silent Train” framework, built on a series of rapidly rotating compromised devices, to infiltrate hundreds of critical infrastructure networks.

The scammers affected approximately 800 victims and led to losses of more than half a million dollars, the Justice Department said.

The defect in a widely distributed open-source library provoked an emergency response, yet exploitation hasn’t been observed in the wild.

Storm-0940 used the agentic AI penetration testing framework to automate attacks and “reach more than 2,250 tenants at 2,900 sign-in attempts per minute,” Microsoft researchers said.

The project overseeing the programming language is releasing patches Wednesday, with the internet racing to patch the 9.2 rated flaw.

It’s the work of the infamous group behind the attacks on Democrats during the 2016 presidential election, Symantec said.

Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded.

Researchers said the first known attack by Armory Castle, also known as UNC5221, occurred almost seven weeks ago. The threat group previously compromised Ivanti and Citrix customers.

Researchers say the attacks have serious implications for the online advertising world, and regulators.

In its October Patch Tuesday, the tech giant addressed more defects in one month than any annual total on record. Nearly 4 in 5 vulnerabilities affect Windows.