Hackers Now Automate Attacks on 200 Orgs: Patch Edge...

Two things landed in the same week, and they point at the same boring fix. BleepingComputer reports that an open-source AI penetration-testing framework called ARTEX was used by Chinese hackers against more than 200 organizations in 14 countries. And CISA, the US cyber agency, added another batch of actively exploited flaws to its must-patch list, led by an Ivanti VPN product. If you run a 5 to 100 person business with a VPN or firewall appliance, those two stories are the same story.

The point is not that attackers now have magic. They have patience on tap. An AI agent will probe a few hundred networks without getting bored, and a small company with an old VPN is just another row in the list. The old comfort, "we're too small to be worth attacking," was always weaker than owners thought. It gets weaker when the attacker's time per target drops toward zero.

The third piece is the Binance theft, roughly $6 billion by the reporting. Check Point cites a compromised engineer's laptop as part of the path. You don't have $6 billion. You do have a laptop that someone uses for email, web browsing and the bank portal all at once. This post turns those three items into a 30-day plan you can mostly run yourself.

What happened

A quick note on sourcing. The analysis here comes from Apprised.news desk briefs, written by AI analysts who read public reporting and weigh it. I checked the claims below against the original outlets where they're linked.

ARTEX in use. BleepingComputer reports that ARTEX, an open-source multi-agent penetration-testing framework, was used by Chinese hackers against more than 200 organizations across 14 countries. Important caveat: 200 is a count of targets, not confirmed breaches. The desk's analysis also notes that attribution to "Chinese hackers" is reporting rather than published indicators, and that an open-source tool makes attribution harder. No one has published how many of the 200 were actually broken into.
VOLTA. Cisco Talos describes an infostealer that asks an LLM which victims are worth the effort, per Security Affairs. In plain terms, stolen data from smaller targets can be ranked and triaged automatically instead of by a person.
The UK's warning. The UK's National Cyber Security Centre warns that long-tolerated vulnerabilities can now be found and exploited at scale, and predicts AI-powered attacks on critical infrastructure within two years.
The KEV additions. The desk's brief says CISA added 8 exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog in seven days, led by Ivanti Connect Secure, and that the entries to patch are the Ivanti, Cisco, GitLab and VMware ones. Two Ivanti Connect Secure entries carry remediation deadlines: CVE-2026-111357 was due 2026-11-02 and CVE-2026-118527 is due 2026-11-13. See the desk analysis.
KEV deadlines don't bind you. Those dates apply to US federal agencies, not private companies. You get no deadline from anyone, so you have to set your own.
Binance. Check Point's bulletin cites a compromised DevOps engineer's laptop in the theft of roughly $6 billion. North Korea rejects the FBI's allegations, per the desk's summary of RTE's report. The desk's careful read is to be firm on the mundane part (a privileged endpoint was an ordinary weak point) and humble on who did it and exactly how.
Threat-sharing law. Industry groups are urging Congress to renew the cyber threat-sharing law through the defense authorization bill; the stopgap expires Dec. 11. That's a watch item, not something you act on.

The desk's overall read is worth repeating. AI is a force multiplier showing scale of automation, not a new class of capability. The actionable items are mundane: patch edge devices, and separate privileged endpoints from critical systems.

What it means for a small business

Edge devices are the things that face the internet: VPN gateways, firewalls, remote-access portals, a self-hosted code server, a virtualization host. They're exposed by design, they're often installed once and forgotten, and an outsourced IT person may not think of them as "theirs." Privileged endpoints are the machines where someone logs into the bank, the domain registrar, payroll or the cloud console. Attackers like both because one foothold goes a long way.

Here are three hypothetical examples with the arithmetic shown.

A 25-person accounting firm with an old VPN

The firm runs an Ivanti Connect Secure VPN installed in 2023 that nobody has updated. It also hosts a GitLab server for its client portal code. Nobody ever wrote down what's reachable from the internet.

The owner spends one afternoon listing three internet-facing items: the VPN, the firewall and the GitLab server. The VPN is two versions behind. The firm gives itself a 14-day internal deadline (no one else will set one), schedules the patch for a Saturday night when no one's working, and turns on automatic updates for the firewall and GitLab. Cost: about 4 hours of the IT person's time. Downtime: roughly 30 minutes on a Saturday. The alternative is leaving a VPN that CISA lists as actively exploited sitting in front of client tax files.

A 12-person ecommerce company with one do-everything laptop

One operations manager uses a single laptop for email, web browsing, the bank portal, the Shopify admin and the domain registrar. If that laptop picks up an infostealer from a bad download, the attacker gets all four sets of keys at once.

The owner buys a dedicated laptop for $450 that is used only for banking, registrar and admin logins. No email, no browsing. Hardware security keys go on those four accounts: two keys per person is the usual advice (one primary, one spare), at about $50 each, so for one person that's $100. Total outlay: $450 + $100 = $550. Compare that with a single fraudulent bank transfer or a hijacked domain, either of which can cost more than the whole purchase in one afternoon.

A 40-person contractor with a part-time IT consultant

The consultant bills $95 an hour. The owner budgets 6 hours for three jobs: an edge-device inventory, a patch pass and an admin-account review. That's 6 × $95 = $570.

Then the owner asks the cyber insurer for a typical recovery estimate for a ransomware incident at a company this size, and gets the figure in writing. Whatever number comes back, the comparison is $570 now against that number later. The owner also asks what the policy expects on patching and MFA, because a policy can quietly require controls you don't have. I can't tell you the right figure for your business, which is why the prompt below asks the AI to work from your own policy documents.

What to do this week

Inventory what faces the internet. List every device or service reachable from outside: VPN, firewall, remote-access gateway, self-hosted code or file server, virtualization host. For each, write down vendor, model and current version. If you don't know what's exposed, ask your IT provider for a list, and consider checking your public DNS records with the DNS and email audit so you can spot forgotten hosts.
Match the list against CISA's KEV catalog and vendor advisories. Patch Ivanti, Cisco, GitLab and VMware entries first. Give yourself a 14-day internal deadline, since the KEV dates don't apply to you. The Ivanti Connect Secure entries are the ones named in this week's analysis.
Stop relying on memory. Turn on automatic updates or set a monthly patch window for every edge device. If a vendor no longer supports an appliance, plan to replace it. An unsupported box can't be patched no matter how disciplined you are.
Name your privileged people and give them a separate device. Write down who holds domain admin, registrar, bank, payroll, cloud console and code hosting access. Give those people a locked-down laptop, or at minimum a dedicated browser profile, used only for those tasks.
Use phishing-resistant MFA where it matters. Hardware security keys or passkeys on admin, banking and email accounts. Remove standing admin rights from everyday user accounts so ordinary work doesn't run with the keys to everything.
Get your insurer's or IT provider's requirements in writing. Ask what edge-device patching and MFA they expect, and ask before renewal, not after a claim. Check whether your email addresses have turned up in known breaches with the email breach check.
Set alerts and rehearse once. Turn on notifications for new logins and new MFA devices on admin accounts. Write a one-page "admin laptop lost or compromised" plan: who to call, which accounts to lock first, who has the spare security key. Run through it once with the people involved. Friction to expect: the first run will find a missing phone number or an account nobody remembers.

Copy-paste prompts

Use these with whatever AI assistant you already use. Paste in your own documents and data where the prompt says so. Each one tells the AI to say when it's unsure, because a confident wrong patch schedule is worse than none.

Use this one after you've done the inventory, to turn a raw list into a schedule:

Act as a cautious IT consultant for a small business with about [number] employees. Below I will paste a list of our internet-facing devices and software versions, copied from our own inventory. Rank them by patch urgency, tell me which vendor advisories I should look up myself, and give me a two-week patch schedule with a rollback step for each item. Only use the list I give you. If you are unsure whether a version is vulnerable, say so plainly instead of guessing, and tell me where to verify it.

[paste inventory here]

Use this one to write your separate-admin-device policy before you buy the laptop:

Write a plain-English one-page policy for our business that separates privileged work (banking, domain registrar, cloud admin, payroll) from everyday browsing and email. Base it on the account list and device list I paste below. Include which devices, which accounts, MFA rules, and what to do if a privileged laptop is lost or suspected compromised. Keep it under 400 words. Flag any account or device on my list that you can't classify and ask me about it rather than assuming.

[paste account list and device list here]

Use this one before a call with your IT provider, so you know what a good answer sounds like:

I run a business with a VPN appliance from [vendor] and a self-hosted [GitLab/file server/other]. Using the notes I paste below about how our IT provider currently handles updates, give me a checklist of questions to ask them about patch timing, logging, MFA and backups, and describe what a good answer sounds like for each. Where my notes are silent on something, list it as an unknown to ask about instead of assuming it's fine. Tell me if any question depends on facts you can't know from my notes.

[paste your notes about current IT arrangements]

Use this one when you're ready to contact your broker about coverage conditions:

Draft a short, polite email to my insurance broker. I will paste the relevant parts of our cyber insurance policy below. Ask what edge-device patching, MFA and endpoint controls the policy expects, and whether a compromised admin laptop would affect coverage. Quote the policy language I give you where it matters. If the pasted text doesn't answer a point, say that it's unclear and turn it into a question for the broker. Do not tell me what the policy covers beyond what the text says.

[paste policy excerpts here]

Use this one to turn all of the above into a calendar your team can follow:

Create a 30-day calendar for a small business to inventory internet-facing systems, patch them, move admin accounts to hardware keys, and test a lost-laptop recovery drill. Use the staff list and hours I paste below. Assign each task to 'owner', 'IT provider' or 'staff' and estimate hours per task. Mark any estimate you are unsure about, and note which tasks depend on information I haven't given you.

[paste staff list, available hours and any existing IT contract details]

Download the kit

The kit is a printable markdown file with an internet-facing asset inventory worksheet, a 14-day patch checklist, a privileged-access register, an MFA rollout tracker, an insurer and IT-provider question list with a sample email, a one-page lost-laptop response plan, a 30-day calendar and the prompts above ready to paste. Get it here: Edge Device and Admin Laptop Hardening Kit.

Fact-check notes and sources

Apprised.news analysis (2026-11-03): the desk's weighted read, the KEV additions and deadlines, and the point that KEV deadlines bind federal agencies, not private companies. Tech and cyber desk, 2026-11-03
Apprised.news analysis (2026-11-02): background on the Binance attribution and the Ivanti entries. Tech and cyber desk, 2026-11-02
ARTEX reporting: the 200 organizations in 14 countries claim (a target count, not confirmed breaches). BleepingComputer
VOLTA: infostealer that asks an LLM to rank victims by value. Security Affairs
UK NCSC warning: long-tolerated vulnerabilities exploited at scale, prediction of AI-powered attacks on critical infrastructure within two years. NCSC
Binance and the privileged laptop: a compromised DevOps engineer's laptop cited in the theft. Check Point Research
North Korea's rejection of the FBI's allegations: reported alongside the theft. RTE
FBI attribution and the heist figure: the FBI's public naming of a state-linked group. BleepingComputer
Threat-sharing law renewal: the Dec. 11 stopgap and industry push through the defense authorization bill. Nextgov

Hackers Now Automate Attacks on 200 Orgs: Patch Edge Devices, Lock Admin PCs