Search — “Vapor Panda”

CrowdStrike, as reported by BleepingComputer, says China-nexus actor Vapor Panda used the ARTEX AI multi-agent penetration-testing framework, directed by a human operator, in a campaign starting October 17 against more than 200 organizations in 14 countries. The sources say at least nine organizations were compromised and at least 12 more were password-sprayed or credential-scanned, with AI agents performing reconnaissance, exploitation, web shell deployment, and credential harvesting while skipping Falcon-protected Windows hosts. Hunters should look for web server processes spawning shells, web shells, forged administrator tokens, and mailbox reads using keys from an old mail-server directory export, plus BLOODALCHEMY backdoor activity.

CrowdStrike reports China-nexus VAPOR PANDA used the ARTEX agentic AI framework (DeepSeek plus a commercial LLM) against 200+ organizations in 14+ countries starting Oct 17, 2026, with confirmed post-exploitation at nine organizations including financial-sector targets in the US. Tradecraft included unsigned SAML assertions and XXE to query cloud IMDS, web shells, LAPS reads, RBCD impersonation, forged mail admin tokens, VPN access with leaked keys, password spraying, and checks for hosts lacking Falcon via tasklist. BLOODALCHEMY was sideloaded via a renamed GameHook binary (svchost.exe) loading graphics-hook-filter64.dll. Hunt for artx/artex command-line strings, artx-prefixed cloud roles, art18- admin-command comments, C:\ProgramData\artx5v\, and svchost.exe outside System32 loading graphics-hook DLLs.