Vapor Panda uses AI pentest framework ARTEX and DeepSeek against 200+ organizations worldwide since 17 October 2026
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 31/10/2026 00:06; os links antigos trazem para cá.
Fontes: cyberscoop.com ↗ thehackernews.com ↗ crowdstrike.com ↗
CrowdStrike attributes a campaign that began on 17 October 2026 to the China-nexus adversary Vapor Panda (formerly VexatiousTemper, overlapping with Trend Micro's Earth Estries). The group uses the Go-based agentic AI penetration testing framework ARTEX, paired with DeepSeek. It has targeted more than 200 organizations in at least 14 countries (cyberscoop.com, thehackernews.com). Targets include foreign ministries in Latin America, Europe, Asia and the Middle East, a European country's presidency and prime minister's office, defense and intelligence agencies, 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors, think tanks, and telecom providers in the U.S., Belgium and the Philippines. CrowdStrike's first publication (crowdstrike.com) announced the activity, but the captured page held only navigation text. Details come from later coverage (thehackernews.com, cyberscoop.com). CrowdStrike calls this the first time it has seen an agentic nation-state adversary at this scale (cyberscoop.com). It also disclosed four previously undocumented China-linked groups: Hollow Panda, Overcast Panda, Titan Panda and Veiled Panda (thehackernews.com).
Entenda a falha
A vulnerabilidade
Titan Panda exploited a hard-coded IIS machine key in Intapp Time Server, legal billing software, to get remote code execution through ViewState deserialization. No CVE is assigned. CrowdStrike says any organization running default installations may be exposed. The attacker needs network access to the IIS application and knowledge of the key, and gets code execution on the server. The articles give no affected or fixed versions and describe no vendor patch. Separately, the Vapor Panda ARTEX campaign chained an unsigned SAML assertion with an XXE flaw to reach the cloud Instance Metadata Service, abused an unauthenticated orchestration service for root in a container environment, and used authentication keys not rotated since 2022. No product or CVE is named for those.
Como funciona
Intapp Time Server runs on IIS, which uses a machine key to protect and validate ViewState, the state data exchanged between client and server. Because default installations share the same hard-coded key, anyone who knows it can build ViewState data that the server accepts as genuine. The server then deserializes that data, and this is the step where it goes wrong: attacker-controlled content is processed and leads to code execution. Titan Panda then deployed the in-memory framework IceGiant for reconnaissance, persistence, lateral movement and data exfiltration.
Por que é vulnerável
The root cause is a hard-coded IIS machine key shipped in default installations instead of a unique secret per deployment. ViewState integrity protection is only as strong as that secret, so once the key is known, forged data can be deserialized. CrowdStrike does not know how Titan Panda got the keys. It suggests that compromising one legal entity running Intapp Time Server may have exposed the hard-coded keys in the application's configuration file. The articles describe no vendor fix.
Onde está
The articles name no file, function or commit; they only say the hard-coded machine key may sit in the application's configuration file.
Como foi descoberta
CrowdStrike says it first detected the Titan Panda attacks on Intapp Time Server in April 2026 and described them in an analysis published on 29 October 2026 alongside three other newly documented China-linked groups. It assesses the actor as active since at least 2021, with North American legal organizations compromised for over two years. The articles do not say who found the weakness or whether it was reported to the vendor. How the actor obtained the default keys is unknown.
Explicação gerada por IA a partir da matéria e dos artigos, em 31/10/2026 00:22.
Detalhes técnicos
- ARTEX orchestrates planner and worker agents backed by DeepSeek and an unidentified subscription-based commercial LLM, with a human operator steering them. The agents write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. In one intrusion the planning agents consumed about 1.4 billion input tokens (thehackernews.com).
- The operator can issue requests as often as every 10 seconds and pursue several attack paths at once. CrowdStrike's hands-on-keyboard baseline was up to 40 commands per hour; with ARTEX it has seen more than 1,500 per hour (cyberscoop.com).
- Agents work web apps, cloud, containers, Active Directory, mail and VPN in parallel and switch approach when one path fails (thehackernews.com).
- Observed chain 1: an unsigned SAML assertion plus an XXE flaw used to query the cloud Instance Metadata Service. This gave a role able to issue commands to thousands of instances and led to recovery of an enterprise administrator account (thehackernews.com).
- Observed chain 2: web shells, an unauthenticated orchestration service abused for root access in a container environment, LAPS password reads, and resource-based constrained delegation to impersonate a privileged account (thehackernews.com).
- Observed chain 3: authentication keys not rotated since 2022 used to forge an administrator token and read mailboxes. VPN configurations from a user's sent mail and a VPN client key from a purported May 2024 email leak then gave access to the internal network (thehackernews.com).
- Post-exploitation at nine organizations involved BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying, network scanning and reconnaissance. At least 12 more organizations saw password-spraying and credential-scanning activity (thehackernews.com).
- Mass exploitation followed by web shell deployment was described by CrowdStrike's Adam Meyers. No specific CVEs or IOCs are named for the campaign (cyberscoop.com).
- ARTEX's developer, Li Puhua ("Autumn-27"), took it closed source after broad adoption by threat actors. Zscaler ThreatLabz said it lowers the technical barrier for complex intrusions (thehackernews.com).
- CrowdStrike counted about 45 agentic adversary attacks in September and 126 in October, roughly threefold month-over-month growth (cyberscoop.com).
- Overcast Panda targets people traveling to China. It uses close-access intrusions to deploy its proprietary FlowCloud backdoor via DLL sideloading. FlowCloud uses legitimate cloud infrastructure for C2 and supports keylogging, screen capture, file collection and credential harvesting (thehackernews.com).
- Titan Panda exploited a hard-coded IIS machine key in Intapp Time Server (ViewState deserialization) for RCE against law firms. Attacks were first detected in April 2026 and deployed the in-memory framework IceGiant. The actor is assessed as active since at least 2021 (thehackernews.com; the source text is truncated after this point).
Remediação
CrowdStrike's guidance is general: maintain visibility across endpoints, identities and cross-domain telemetry, since the attacks use familiar techniques at unfamiliar speed and scale (cyberscoop.com). Based on the observed chains, defenders should also rotate long-lived authentication keys, review SAML signature validation and XXE exposure, restrict access to cloud metadata services, and watch for password spraying and LAPS password reads. These are inferences from the reported techniques, not vendor-issued guidance.
Relatos divergentes
- Scale of compromise: cyberscoop.com says about 140 of the 200+ targets were compromised in 11 days, with roughly 70% confirmed compromised or showing moderate-confidence evidence of intrusion. thehackernews.com reports confirmed post-exploitation at nine organizations and password spraying against at least 12 more. The two may measure different things (confirmed post-exploitation versus broader compromise or intrusion evidence), and the sources do not reconcile them. The cyberscoop.com figures are the more recent and more specific.
- Related ARTEX activity: cyberscoop.com states this campaign is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier in October, which included a supply-chain attack on ConnectWise customers.
Linha do tempo
-
China-nexus Vapor Panda uses ARTEX agentic AI pentesting framework to compromise ~140 sensitive targets in 11 days
ler a análise desta fonte ocultar
CrowdStrike reports that the China state-backed group it tracks as Vapor Panda is using the agentic AI penetration testing framework ARTEX, paired with DeepSeek, in an active campaign. Since Oct. 17, the group has targeted more than 200 organizations in at least 14 countries and compromised about 140 of them in 11 days. CrowdStrike says roughly 70% of targets were confirmed compromised or showed moderate-confidence evidence of intrusion. Victims and targets include foreign ministries, a European country's presidency and prime minister's office, defense and intelligence agencies, 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in the United States, Belgium and the Philippines. CrowdStrike calls this the first time it has seen an agentic nation-state adversary at this scale.
Technical Details
- ARTEX lets the operator issue requests as often as every 10 seconds and pursue multiple attack paths concurrently.
- CrowdStrike's historical hands-on-keyboard baseline was up to 40 commands per hour. With ARTEX it has seen more than 1,500 commands per hour.
- CrowdStrike describes mass exploitation of targets followed by webshell deployment (as described by CrowdStrike's Adam Meyers). The article names no specific CVEs or IOCs.
- The campaign is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier this month, which included a supply-chain attack on ConnectWise customers.
- CrowdStrike counted about 45 agentic adversary attacks in September and 126 in October, roughly threefold month-over-month growth.
Remediation
CrowdStrike's guidance is general: maintain visibility across endpoints, identities and cross-domain telemetry. The attacks use familiar techniques at unfamiliar speed and scale.
-
Vapor Panda uses AI pentest framework ARTEX against 200+ organizations worldwide; CrowdStrike also profiles four new China-nexus groups
ler a análise desta fonte ocultar
CrowdStrike attributes a campaign starting 17 October 2026 to the China-based adversary Vapor Panda (formerly VexatiousTemper, overlapping with Trend Micro's Earth Estries), which used the Go-based AI penetration testing framework ARTEX against more than 200 organizations. Targets include foreign ministries in Latin America, Europe, Asia and the Middle East, U.S. semiconductor, defense, pharmaceutical, nuclear, financial and think tank organizations, and telecommunications providers in the U.S., Belgium and the Philippines. Post-exploitation was confirmed at nine organizations, where the actor deployed BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying, network scanning and reconnaissance. At least 12 more organizations faced password-spraying and credential-scanning activity. CrowdStrike also disclosed four previously undocumented China-linked groups: Hollow Panda, Overcast Panda, Titan Panda and Veiled Panda.
Technical Details
- ARTEX orchestrates planner and worker agents backed by DeepSeek and an unidentified subscription-based commercial LLM, with a human operator steering the agents. They write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. In one intrusion the planning agents consumed about 1.4 billion input tokens.
- Observed attack chains: an unsigned SAML assertion plus an XXE flaw to query the cloud Instance Metadata Service, leading to a role able to issue commands to thousands of instances and recovery of an enterprise administrator account.
- Other chains: web shells, an unauthenticated orchestration service abused for root access in a container environment, LAPS password reads, and resource-based constrained delegation to impersonate a privileged account.
- In another case, authentication keys not rotated since 2022 were used to forge an administrator token and read mailboxes. VPN configurations from a user's sent mail and a VPN client key from a purported May 2024 email leak then gave access to the internal network.
- Agents pursued multiple paths in parallel (web apps, cloud, containers, Active Directory, mail, VPN) and switched approach when one failed.
- ARTEX's developer, Li Puhua ("Autumn-27"), took it closed source after broad adoption by threat actors. Zscaler ThreatLabz described it as lowering the technical barrier for complex intrusions.
- Overcast Panda targets people traveling to China, using close-access intrusions to deploy its proprietary FlowCloud backdoor via DLL sideloading. FlowCloud uses legitimate cloud infrastructure for C2 and supports keylogging, screen capture, file collection and credential harvesting.
- Titan Panda exploited a hard-coded IIS machine key in Intapp Time Server (ViewState deserialization) for RCE against law firms. Attacks were first detected in April 2026 and deployed the in-memory framework IceGiant. The actor is assessed as active since at least 2021, with North American legal organizations compromised for over two years.
Remediation
- Rotate long-lived authentication and signing keys, and replace default or hard-coded machine keys (including on Intapp Time Server installations).
- Validate SAML assertion signatures, fix XXE exposure and restrict access to the cloud instance metadata service.
- Detect and limit password spraying, protect LAPS passwords and review delegation settings.
- Harden VPN credentials and mailbox content hygiene.
- Apply device-handling precautions for staff traveling to China.
-
VAPOR PANDA leverages AI-driven ARTEX tooling to scale global cyber espionage campaign
ler a análise desta fonte ocultar
CrowdStrike Counter Adversary Operations reports that the China-nexus adversary VAPOR PANDA is using an AI-driven capability tracked as ARTEX to scale a global espionage campaign. The publication frames the activity as part of a broader trend of adversaries operationalizing AI to increase the speed and breadth of targeted intrusion operations, alongside CrowdStrike's related reporting on agentic AI campaigns and intensifying China-nexus activity. The retrieved page content was limited to site navigation, so technical specifics, victimology and indicators could not be extracted from this capture. Defenders tracking China-nexus espionage should consult the full CrowdStrike advisory for detection guidance.