Vapor Panda uses AI pentest framework ARTEX and DeepSeek against 200+ organizations worldwide since 17 October 2026
Matéria consolidada. Reúne 7 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 04/11/2026 00:09; os links antigos trazem para cá.
Fontes: helpnetsecurity.com ↗ bleepingcomputer.com ↗ cyberscoop.com ↗ thehackernews.com ↗ crowdstrike.com ↗
CrowdStrike attributes a campaign that began on 17 October 2026 to the China-nexus adversary Vapor Panda (formerly VexatiousTemper, overlapping with Trend Micro's Earth Estries). The group uses the Go-based agentic AI penetration testing framework ARTEX, built mainly on DeepSeek. It has targeted more than 200 organizations in at least 14 countries over 11 days (cyberscoop.com, thehackernews.com, bleepingcomputer.com, helpnetsecurity.com). Targets include foreign ministries in Latin America, Europe, Asia and the Middle East, a European country's presidency and prime minister's office, defense and intelligence agencies, 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors, think tanks, and telecom providers in the U.S., Belgium and the Philippines. CrowdStrike's first publication (crowdstrike.com) announced the activity, but the captured page held only navigation text. Details come from later coverage (thehackernews.com, cyberscoop.com, bleepingcomputer.com, helpnetsecurity.com). CrowdStrike calls this the first time it has seen an agentic nation-state adversary at this scale (cyberscoop.com), and describes an escalation from single intrusions to multiple simultaneous engagements directed by one human operator (bleepingcomputer.com). It also disclosed four previously undocumented China-linked groups: Hollow Panda, Overcast Panda, Titan Panda and Veiled Panda (thehackernews.com). Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) says an AI-driven attack on its own network in September 2026 used ARTEX AI (bleepingcomputer.com). A separate, smaller campaign reported by Kaspersky used the open-source CyberStrikeAI framework against educational institutions in Africa and Latin America, attributed with moderate confidence to Chinese-speaking operators (helpnetsecurity.com).
Entenda a falha
A vulnerabilidade
No CVEs are listed. The clearest flaw is in Intapp Time Server, legal billing software running on IIS, which uses a hard-coded IIS machine key. CrowdStrike says Titan Panda used it for remote code execution against law firms through ViewState deserialization, and that any default installation is exposed. Affected and fixed versions are not given. Separately, DIVD says an ARTEX agent chained a Zammad zero-day with a local privilege escalation zero-day to go from initial access to root in 12 minutes. For those, no CVEs, versions, requirements or patches are stated. The Vapor Panda chains also used an unsigned SAML assertion with XXE and an unauthenticated orchestration service, in unnamed products.
Como funciona
In Intapp Time Server, the IIS application uses a machine key to validate and protect ViewState, the state data the web app exchanges with clients. Because the key is hard-coded and identical across default installs, anyone who knows it can craft ViewState data that the server accepts as genuine. The server then deserializes it, and that is where code execution happens. CrowdStrike says the key may have leaked from the application's configuration file on a compromised legal entity. For the Zammad and privilege escalation zero-days, the articles describe only the sequence: initial access, root, then mailbox reading, internal scanning, token extraction and password-reset attempts. They do not say where either flaw fails.
Por que é vulnerável
For Intapp Time Server, the root cause is an insecure default: a secret machine key embedded in the product and shared across installations, so the secret protecting ViewState is effectively public once it is found. The articles do not say what a fix changes or whether one exists. For the Zammad and local privilege escalation zero-days, no root cause, reason they went unnoticed or fix is described. The SAML, XXE and unrotated-key issues in the Vapor Panda chains are presented as weaknesses or misconfigurations (an unsigned assertion, keys not rotated since 2022), not as product bugs with patches.
Como foi descoberta
CrowdStrike first detected the Titan Panda attacks on Intapp Time Server in April 2026 and assesses the actor as active since at least 2021. It does not know how the actor obtained the default keys. The Zammad chain came to light when DIVD was attacked in September 2026. DIVD later said in a LinkedIn post that the tool was ARTEX AI, acting autonomously, and recorded over 450,000 requests and 2,500 scripts. BleepingComputer does not tie that intrusion to Vapor Panda. The articles do not say how the zero-days were found or whether Zammad's maintainers were notified.
Explicação gerada por IA a partir da matéria e dos artigos, em 04/11/2026 00:24.
Detalhes técnicos
- ARTEX orchestrates planner and worker agents backed by DeepSeek and an unidentified subscription-based commercial LLM, with a human operator steering them. A main agent delegates to planner and worker agents that share a knowledge graph (helpnetsecurity.com). The agents write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. In one intrusion the planning agents consumed about 1.4 billion input tokens (thehackernews.com; bleepingcomputer.com reports more than 1.4 billion; helpnetsecurity.com says roughly 1.4 billion).
- Operators issued instructions in Chinese and intervened at key decision points. The agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and switched to alternative attack paths when needed (bleepingcomputer.com). The LLM itself decided commands, rather than only assisting with reconnaissance or phishing content (helpnetsecurity.com).
- Operators told the agents to skip Windows hosts protected by CrowdStrike Falcon and to focus on unprotected hosts (bleepingcomputer.com).
- The operator can issue requests as often as every 10 seconds and pursue several attack paths at once. CrowdStrike's hands-on-keyboard baseline was up to 40 commands per hour; with ARTEX it has seen more than 1,500 per hour (cyberscoop.com).
- Agents work web apps, cloud, containers, Active Directory, mail and VPN in parallel and switch approach when one path fails (thehackernews.com).
- Confirmed victims named by bleepingcomputer.com: telecommunications providers in the US and Belgium; government organizations in Greece, the Middle East and Latin America; pharmaceutical firms in the US.
- Observed chain 1: an unsigned SAML assertion plus an XXE flaw used to query the cloud Instance Metadata Service. This gave a role able to issue commands to thousands of instances and led to recovery of an enterprise administrator account (thehackernews.com; helpnetsecurity.com also describes escalation to enterprise admin).
- Observed chain 2: web shells, an unauthenticated orchestration service abused for root access in a container environment, LAPS password reads, and resource-based constrained delegation to impersonate a privileged account (thehackernews.com).
- Observed chain 3: authentication keys not rotated since 2022 used to forge an administrator token and read mailboxes. VPN configurations from a user's sent mail and a VPN client key from a purported May 2024 email leak then gave access to the internal network (thehackernews.com). In the Greek government intrusion, the agents forged the administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export (bleepingcomputer.com; helpnetsecurity.com also describes the 2022 export and VPN configurations from a 2024 email leak).
- Post-exploitation at nine organizations involved BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying, network scanning and reconnaissance. At least 12 more organizations saw password-spraying and credential-scanning activity (thehackernews.com; bleepingcomputer.com also reports at least nine compromised and at least 12 other high-value targets sprayed or scanned; helpnetsecurity.com confirms the same counts). BLOODALCHEMY, active since 2023, was deployed against government entities in Latin America and the Middle East (bleepingcomputer.com).
- Mass exploitation followed by web shell deployment was described by CrowdStrike's Adam Meyers. No specific CVEs or IOCs are named for the campaign (cyberscoop.com).
- ARTEX's developer, Li Puhua ("Autumn-27"), took it closed source after broad adoption by threat actors. Zscaler ThreatLabz said it lowers the technical barrier for complex intrusions (thehackernews.com). ARTEX AI was first released as open source and later made proprietary after real-world abuse, including a campaign against South Korean financial institutions (bleepingcomputer.com).
- CrowdStrike counted about 45 agentic adversary attacks in September and 126 in October, roughly threefold month-over-month growth (cyberscoop.com).
- Microsoft has reported separate ARTEX use by Storm-0940, which helpnetsecurity.com reads as a sign the framework is spreading among China-nexus actors.
- DIVD intrusion (September 2026): DIVD says it went from initial access to root in 12 minutes by chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent read a mailbox, scanned the internal network, extracted login tokens and attempted password resets. DIVD recorded over 450,000 requests and 2,500 scripts, calling the activity "super loud and messy." The source does not name CVEs and does not attribute this intrusion to Vapor Panda (bleepingcomputer.com).
- Overcast Panda targets people traveling to China. It uses close-access intrusions to deploy its proprietary FlowCloud backdoor via DLL sideloading. FlowCloud uses legitimate cloud infrastructure for C2 and supports keylogging, screen capture, file collection and credential harvesting (thehackernews.com).
- Titan Panda exploited a hard-coded IIS machine key in Intapp Time Server (ViewState deserialization) for RCE against law firms. Attacks were first detected in April 2026 and deployed the in-memory framework IceGiant. The actor is assessed as active since at least 2021 (thehackernews.com; the source text is truncated after this point).
- Separate Kaspersky-reported CyberStrikeAI campaign (helpnetsecurity.com): attackers manually compromised a SQL Server, then deployed the AI-driven implant, which achieved persistence and local recon within two minutes, domain mapping within five hours, and full domain admin compromise within three to four days, using Kerberoasting, AS-REP Roasting, LSASS dumps, DCSync and Golden Ticket attacks. Attribution to Chinese-speaking operators is moderate confidence, based on Chinese code comments, use of dnslog[.]cn, and UTC+8 business-hour C2 activity. This campaign is not tied to Vapor Panda.
Remediação
CrowdStrike's guidance is general: maintain visibility across endpoints, identities and cross-domain telemetry, since the attacks use familiar techniques at unfamiliar speed and scale (cyberscoop.com). helpnetsecurity.com reports that CrowdStrike specifically recommends rotating keys and credentials after any suspected exposure, enforcing SAML signature validation and IMDSv2, hunting for ARTEX markers, patching internet-facing appliances, and deploying EDR broadly across environments, since attackers target detection gaps. bleepingcomputer.com gives no explicit remediation guidance, but notes that endpoint protection coverage matters, since operators steered agents away from Falcon-protected Windows hosts and toward unprotected ones. Defenders should also restrict access to cloud metadata services, review XXE exposure, and watch for password spraying and LAPS password reads; these are inferences from the reported techniques, not vendor-issued guidance. No patch information was given for the Zammad zero-days in the DIVD incident.
Relatos divergentes
- Scale of compromise: cyberscoop.com says about 140 of the 200+ targets were compromised in 11 days, with roughly 70% confirmed compromised or showing moderate-confidence evidence of intrusion. thehackernews.com, bleepingcomputer.com and helpnetsecurity.com report confirmed compromise or post-exploitation at nine organizations and password spraying against at least 12 more. The two may measure different things (confirmed post-exploitation versus broader compromise or intrusion evidence), and the sources do not reconcile them. The cyberscoop.com figures are the more specific.
- Related ARTEX activity: cyberscoop.com states this campaign is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier in October, which included a supply-chain attack on ConnectWise customers. helpnetsecurity.com also describes the Storm-0940 use as separate. bleepingcomputer.com adds the DIVD September 2026 intrusion and the earlier campaign against South Korean financial institutions as other ARTEX abuse, without tying them to Vapor Panda.
Linha do tempo
-
AI-Agent Frameworks ARTEX and CyberStrikeAI Power Chinese-Linked Espionage Campaigns Against 200+ Organizations
ler a análise desta fonte ocultar
CrowdStrike and Kaspersky separately reported China-nexus threat actors using agentic AI frameworks to plan and execute intrusions, with the LLM itself deciding commands rather than just assisting with reconnaissance or phishing content. CrowdStrike tracked the group Vapor Panda using a new framework called ARTEX, built mainly on DeepSeek, to hit organizations in at least 14 countries over 11 days starting October 17, 2026, including foreign ministries, US defense and semiconductor firms, telecoms, and think tanks. Post-exploitation with the BloodAlchemy backdoor was confirmed at nine organizations, and password spraying was observed against at least 12 more. Separately, Kaspersky detailed a smaller campaign against educational institutions in Africa and Latin America using the open-source CyberStrikeAI framework, attributed with moderate confidence to Chinese-speaking operators based on Chinese code comments, use of dnslog[.]cn, and UTC+8 business-hour C2 activity.
Technical Details
In the ARTEX campaign, a main agent delegates to planner and worker agents sharing a knowledge graph; one intrusion alone consumed roughly 1.4 billion input tokens, with human operators stepping in at decision points using Chinese-language instructions. Observed techniques include chaining an unsigned SAML assertion with an XXE flaw to reach cloud instance metadata services and escalate to enterprise admin, and reusing a 2022 directory export of unrotated mail server authentication keys against a Greek government entity to forge admin tokens and access VPN configurations from a 2024 email leak. Microsoft has also reported separate ARTEX use by Storm-0940, suggesting the framework is spreading among China-nexus actors. In the CyberStrikeAI campaign, attackers manually compromised a SQL Server, then deployed the AI-driven implant which achieved persistence and local recon within two minutes, domain mapping within five hours, and full domain admin compromise within three to four days, using Kerberoasting, AS-REP Roasting, LSASS dumps, DCSync, and Golden Ticket attacks.
Remediation
CrowdStrike recommends rotating keys and credentials after any suspected exposure, enforcing SAML signature validation and IMDSv2, hunting for ARTEX markers, patching internet-facing appliances, and deploying EDR broadly across environments, since attackers specifically target detection gaps.
-
China-nexus Vapor Panda uses ARTEX AI agents in automated intrusions against 200+ organizations in 14 countries
ler a análise desta fonte ocultar
CrowdStrike reports that the China-nexus actor Vapor Panda used ARTEX AI, a multi-agent AI penetration-testing framework, in a campaign that began on October 17 against more than 200 organizations in 14 countries. Targets included government ministries, telecommunications providers, and the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. At least nine organizations were compromised, and password spraying and credential scanning were run against at least 12 other high-value targets. CrowdStrike calls this an escalation from single intrusions to multiple simultaneous engagements directed by one human operator. Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) says the AI-driven attack on its network in September 2026 used ARTEX AI.
Technical Details
- Confirmed victims: telecommunications providers in the US and Belgium; government organizations in Greece, the Middle East, and Latin America; pharmaceutical firms in the US.
- In the Greek government intrusion, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export.
- Vapor Panda used DeepSeek and a second, unidentified commercial LLM to coordinate planning and worker agents across several intrusions at once. Operators issued instructions in Chinese and intervened at key decision points.
- The agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and switched to alternative attack paths when needed.
- Operators told the agents to skip Windows hosts protected by CrowdStrike Falcon and to focus on unprotected hosts.
- In one intrusion the agents consumed more than 1.4 billion input tokens, according to the researchers.
- The BLOODALCHEMY backdoor, active since 2023, was deployed against government entities in Latin America and the Middle East.
- ARTEX AI was first released as open source and later made proprietary after real-world abuse, including a campaign against South Korean financial institutions.
- DIVD says its intrusion went from initial access to root in 12 minutes by chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent read a mailbox, scanned the internal network, extracted login tokens, and attempted password resets. DIVD recorded over 450,000 requests and 2,500 scripts, describing the activity as "super loud and messy."
Remediation
The article gives no explicit remediation guidance. It implies that endpoint protection coverage matters, since operators steered agents away from Falcon-protected Windows hosts and toward unprotected ones.
-
China-nexus Vapor Panda uses ARTEX agentic AI pentesting framework to compromise ~140 sensitive targets in 11 days
ler a análise desta fonte ocultar
CrowdStrike reports that the China state-backed group it tracks as Vapor Panda is using the agentic AI penetration testing framework ARTEX, paired with DeepSeek, in an active campaign. Since Oct. 17, the group has targeted more than 200 organizations in at least 14 countries and compromised about 140 of them in 11 days. CrowdStrike says roughly 70% of targets were confirmed compromised or showed moderate-confidence evidence of intrusion. Victims and targets include foreign ministries, a European country's presidency and prime minister's office, defense and intelligence agencies, 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in the United States, Belgium and the Philippines. CrowdStrike calls this the first time it has seen an agentic nation-state adversary at this scale.
Technical Details
- ARTEX lets the operator issue requests as often as every 10 seconds and pursue multiple attack paths concurrently.
- CrowdStrike's historical hands-on-keyboard baseline was up to 40 commands per hour. With ARTEX it has seen more than 1,500 commands per hour.
- CrowdStrike describes mass exploitation of targets followed by webshell deployment (as described by CrowdStrike's Adam Meyers). The article names no specific CVEs or IOCs.
- The campaign is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier this month, which included a supply-chain attack on ConnectWise customers.
- CrowdStrike counted about 45 agentic adversary attacks in September and 126 in October, roughly threefold month-over-month growth.
Remediation
CrowdStrike's guidance is general: maintain visibility across endpoints, identities and cross-domain telemetry. The attacks use familiar techniques at unfamiliar speed and scale.
-
Vapor Panda uses AI pentest framework ARTEX against 200+ organizations worldwide; CrowdStrike also profiles four new China-nexus groups
ler a análise desta fonte ocultar
CrowdStrike attributes a campaign starting 17 October 2026 to the China-based adversary Vapor Panda (formerly VexatiousTemper, overlapping with Trend Micro's Earth Estries), which used the Go-based AI penetration testing framework ARTEX against more than 200 organizations. Targets include foreign ministries in Latin America, Europe, Asia and the Middle East, U.S. semiconductor, defense, pharmaceutical, nuclear, financial and think tank organizations, and telecommunications providers in the U.S., Belgium and the Philippines. Post-exploitation was confirmed at nine organizations, where the actor deployed BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying, network scanning and reconnaissance. At least 12 more organizations faced password-spraying and credential-scanning activity. CrowdStrike also disclosed four previously undocumented China-linked groups: Hollow Panda, Overcast Panda, Titan Panda and Veiled Panda.
Technical Details
- ARTEX orchestrates planner and worker agents backed by DeepSeek and an unidentified subscription-based commercial LLM, with a human operator steering the agents. They write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. In one intrusion the planning agents consumed about 1.4 billion input tokens.
- Observed attack chains: an unsigned SAML assertion plus an XXE flaw to query the cloud Instance Metadata Service, leading to a role able to issue commands to thousands of instances and recovery of an enterprise administrator account.
- Other chains: web shells, an unauthenticated orchestration service abused for root access in a container environment, LAPS password reads, and resource-based constrained delegation to impersonate a privileged account.
- In another case, authentication keys not rotated since 2022 were used to forge an administrator token and read mailboxes. VPN configurations from a user's sent mail and a VPN client key from a purported May 2024 email leak then gave access to the internal network.
- Agents pursued multiple paths in parallel (web apps, cloud, containers, Active Directory, mail, VPN) and switched approach when one failed.
- ARTEX's developer, Li Puhua ("Autumn-27"), took it closed source after broad adoption by threat actors. Zscaler ThreatLabz described it as lowering the technical barrier for complex intrusions.
- Overcast Panda targets people traveling to China, using close-access intrusions to deploy its proprietary FlowCloud backdoor via DLL sideloading. FlowCloud uses legitimate cloud infrastructure for C2 and supports keylogging, screen capture, file collection and credential harvesting.
- Titan Panda exploited a hard-coded IIS machine key in Intapp Time Server (ViewState deserialization) for RCE against law firms. Attacks were first detected in April 2026 and deployed the in-memory framework IceGiant. The actor is assessed as active since at least 2021, with North American legal organizations compromised for over two years.
Remediation
- Rotate long-lived authentication and signing keys, and replace default or hard-coded machine keys (including on Intapp Time Server installations).
- Validate SAML assertion signatures, fix XXE exposure and restrict access to the cloud instance metadata service.
- Detect and limit password spraying, protect LAPS passwords and review delegation settings.
- Harden VPN credentials and mailbox content hygiene.
- Apply device-handling precautions for staff traveling to China.
-
VAPOR PANDA leverages AI-driven ARTEX tooling to scale global cyber espionage campaign
ler a análise desta fonte ocultar
CrowdStrike Counter Adversary Operations reports that the China-nexus adversary VAPOR PANDA is using an AI-driven capability tracked as ARTEX to scale a global espionage campaign. The publication frames the activity as part of a broader trend of adversaries operationalizing AI to increase the speed and breadth of targeted intrusion operations, alongside CrowdStrike's related reporting on agentic AI campaigns and intensifying China-nexus activity. The retrieved page content was limited to site navigation, so technical specifics, victimology and indicators could not be extracted from this capture. Defenders tracking China-nexus espionage should consult the full CrowdStrike advisory for detection guidance.