Search — “graphics-hook-filter64.dll”

CrowdStrike reports China-nexus VAPOR PANDA used the ARTEX agentic AI framework (DeepSeek plus a commercial LLM) against 200+ organizations in 14+ countries starting Oct 17, 2026, with confirmed post-exploitation at nine organizations including financial-sector targets in the US. Tradecraft included unsigned SAML assertions and XXE to query cloud IMDS, web shells, LAPS reads, RBCD impersonation, forged mail admin tokens, VPN access with leaked keys, password spraying, and checks for hosts lacking Falcon via tasklist. BLOODALCHEMY was sideloaded via a renamed GameHook binary (svchost.exe) loading graphics-hook-filter64.dll. Hunt for artx/artex command-line strings, artx-prefixed cloud roles, art18- admin-command comments, C:\ProgramData\artx5v\, and svchost.exe outside System32 loading graphics-hook DLLs.