Vapor Panda uses AI pentest framework ARTEX and DeepSeek against 200+ organizations worldwide since 17 October 2026
Matéria consolidada. Reúne 5 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 4 fontes trouxeram em 03/11/2026 00:07; os links antigos trazem para cá.
Fontes: bleepingcomputer.com ↗ cyberscoop.com ↗ thehackernews.com ↗ crowdstrike.com ↗
CrowdStrike attributes a campaign that began on 17 October 2026 to the China-nexus adversary Vapor Panda (formerly VexatiousTemper, overlapping with Trend Micro's Earth Estries). The group uses the Go-based agentic AI penetration testing framework ARTEX, paired with DeepSeek. It has targeted more than 200 organizations in at least 14 countries (cyberscoop.com, thehackernews.com, bleepingcomputer.com). Targets include foreign ministries in Latin America, Europe, Asia and the Middle East, a European country's presidency and prime minister's office, defense and intelligence agencies, 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors, think tanks, and telecom providers in the U.S., Belgium and the Philippines. CrowdStrike's first publication (crowdstrike.com) announced the activity, but the captured page held only navigation text. Details come from later coverage (thehackernews.com, cyberscoop.com, bleepingcomputer.com). CrowdStrike calls this the first time it has seen an agentic nation-state adversary at this scale (cyberscoop.com), and describes an escalation from single intrusions to multiple simultaneous engagements directed by one human operator (bleepingcomputer.com). It also disclosed four previously undocumented China-linked groups: Hollow Panda, Overcast Panda, Titan Panda and Veiled Panda (thehackernews.com). Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) says an AI-driven attack on its own network in September 2026 used ARTEX AI (bleepingcomputer.com).
Entenda a falha
A vulnerabilidade
No CVEs are listed. The clearest flaw is in Intapp Time Server, legal billing software on IIS. It ships a hard-coded IIS machine key, which allows ViewState deserialization and remote code execution against default installations. CrowdStrike says Titan Panda used it against law firms. Affected and fixed versions are not given. Separately, DIVD says an ARTEX agent chained a Zammad zero-day with a second local privilege escalation zero-day, going from initial access to root in 12 minutes. For those two, no CVEs, versions, flaw types, requirements or patch are stated. Vapor Panda's own intrusions also abused an unsigned SAML assertion with an XXE flaw, and an unauthenticated orchestration service, in unnamed products.
Como funciona
In Intapp Time Server, the IIS application uses a machine key to validate and protect ViewState, the state data the web app exchanges with clients. Because the key is hard-coded and the same in every default install, anyone who learns it can craft ViewState data the server accepts as genuine. The server then deserializes it, and that is where code execution happens. CrowdStrike says the key may have leaked from the application's configuration file on a compromised legal entity. For the Zammad and privilege escalation zero-days, the articles describe only the sequence: initial access, then root, then mailbox reading, internal scanning, token extraction and password-reset attempts. They do not say where either flaw fails.
Por que é vulnerável
For Intapp Time Server, the root cause is an insecure default: a secret machine key embedded in the product and shared across installations, so the secret protecting ViewState is effectively public once found. The articles do not say what a fix changes or whether one exists. For the Zammad and local privilege escalation zero-days, no root cause, reason they went unnoticed or fix is described. The SAML, XXE and unrotated-key issues in the chains are described as misconfigurations or weaknesses (an unsigned assertion, keys not rotated since 2022), not as product bugs with patches.
Como foi descoberta
CrowdStrike detected the Titan Panda attacks on Intapp Time Server in April 2026 and says the actor has been active since at least 2021. It does not know how the actor obtained the default keys. The Zammad chain came to light when DIVD was attacked in September 2026. DIVD first blamed an AI agent and later, in a LinkedIn post, named ARTEX AI, acting autonomously. It recorded over 450,000 requests and 2,500 scripts and called the activity "super loud and messy". BleepingComputer does not tie that intrusion to Vapor Panda. The articles do not say how the zero-days were found or whether Zammad's maintainers were notified.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 00:22.
Detalhes técnicos
- ARTEX orchestrates planner and worker agents backed by DeepSeek and an unidentified subscription-based commercial LLM, with a human operator steering them. The agents write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. In one intrusion the planning agents consumed about 1.4 billion input tokens (thehackernews.com; bleepingcomputer.com reports more than 1.4 billion).
- Operators issued instructions in Chinese and intervened at key decision points. The agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and switched to alternative attack paths when needed (bleepingcomputer.com).
- Operators told the agents to skip Windows hosts protected by CrowdStrike Falcon and to focus on unprotected hosts (bleepingcomputer.com).
- The operator can issue requests as often as every 10 seconds and pursue several attack paths at once. CrowdStrike's hands-on-keyboard baseline was up to 40 commands per hour; with ARTEX it has seen more than 1,500 per hour (cyberscoop.com).
- Agents work web apps, cloud, containers, Active Directory, mail and VPN in parallel and switch approach when one path fails (thehackernews.com).
- Confirmed victims named by bleepingcomputer.com: telecommunications providers in the US and Belgium; government organizations in Greece, the Middle East and Latin America; pharmaceutical firms in the US.
- Observed chain 1: an unsigned SAML assertion plus an XXE flaw used to query the cloud Instance Metadata Service. This gave a role able to issue commands to thousands of instances and led to recovery of an enterprise administrator account (thehackernews.com).
- Observed chain 2: web shells, an unauthenticated orchestration service abused for root access in a container environment, LAPS password reads, and resource-based constrained delegation to impersonate a privileged account (thehackernews.com).
- Observed chain 3: authentication keys not rotated since 2022 used to forge an administrator token and read mailboxes. VPN configurations from a user's sent mail and a VPN client key from a purported May 2024 email leak then gave access to the internal network (thehackernews.com). In the Greek government intrusion, the agents forged the administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export (bleepingcomputer.com).
- Post-exploitation at nine organizations involved BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying, network scanning and reconnaissance. At least 12 more organizations saw password-spraying and credential-scanning activity (thehackernews.com; bleepingcomputer.com also reports at least nine compromised and at least 12 other high-value targets sprayed or scanned). BLOODALCHEMY, active since 2023, was deployed against government entities in Latin America and the Middle East (bleepingcomputer.com).
- Mass exploitation followed by web shell deployment was described by CrowdStrike's Adam Meyers. No specific CVEs or IOCs are named for the campaign (cyberscoop.com).
- ARTEX's developer, Li Puhua ("Autumn-27"), took it closed source after broad adoption by threat actors. Zscaler ThreatLabz said it lowers the technical barrier for complex intrusions (thehackernews.com). ARTEX AI was first released as open source and later made proprietary after real-world abuse, including a campaign against South Korean financial institutions (bleepingcomputer.com).
- CrowdStrike counted about 45 agentic adversary attacks in September and 126 in October, roughly threefold month-over-month growth (cyberscoop.com).
- DIVD intrusion (September 2026): DIVD says it went from initial access to root in 12 minutes by chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent read a mailbox, scanned the internal network, extracted login tokens and attempted password resets. DIVD recorded over 450,000 requests and 2,500 scripts, calling the activity "super loud and messy." The source does not name CVEs and does not attribute this intrusion to Vapor Panda (bleepingcomputer.com).
- Overcast Panda targets people traveling to China. It uses close-access intrusions to deploy its proprietary FlowCloud backdoor via DLL sideloading. FlowCloud uses legitimate cloud infrastructure for C2 and supports keylogging, screen capture, file collection and credential harvesting (thehackernews.com).
- Titan Panda exploited a hard-coded IIS machine key in Intapp Time Server (ViewState deserialization) for RCE against law firms. Attacks were first detected in April 2026 and deployed the in-memory framework IceGiant. The actor is assessed as active since at least 2021 (thehackernews.com; the source text is truncated after this point).
Remediação
CrowdStrike's guidance is general: maintain visibility across endpoints, identities and cross-domain telemetry, since the attacks use familiar techniques at unfamiliar speed and scale (cyberscoop.com). bleepingcomputer.com gives no explicit remediation guidance, but notes that endpoint protection coverage matters, since operators steered agents away from Falcon-protected Windows hosts and toward unprotected ones. Based on the observed chains, defenders should also rotate long-lived authentication keys, review SAML signature validation and XXE exposure, restrict access to cloud metadata services, and watch for password spraying and LAPS password reads. These are inferences from the reported techniques, not vendor-issued guidance. No patch information was given for the Zammad zero-days in the DIVD incident.
Relatos divergentes
- Scale of compromise: cyberscoop.com says about 140 of the 200+ targets were compromised in 11 days, with roughly 70% confirmed compromised or showing moderate-confidence evidence of intrusion. thehackernews.com and bleepingcomputer.com report confirmed compromise or post-exploitation at nine organizations and password spraying against at least 12 more. The two may measure different things (confirmed post-exploitation versus broader compromise or intrusion evidence), and the sources do not reconcile them. The cyberscoop.com figures are the more recent and more specific.
- Related ARTEX activity: cyberscoop.com states this campaign is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier in October, which included a supply-chain attack on ConnectWise customers. bleepingcomputer.com adds the DIVD September 2026 intrusion and the earlier campaign against South Korean financial institutions as other ARTEX abuse, without tying them to Vapor Panda.
Linha do tempo
-
China-nexus Vapor Panda uses ARTEX AI agents in automated intrusions against 200+ organizations in 14 countries
ler a análise desta fonte ocultar
CrowdStrike reports that the China-nexus actor Vapor Panda used ARTEX AI, a multi-agent AI penetration-testing framework, in a campaign that began on October 17 against more than 200 organizations in 14 countries. Targets included government ministries, telecommunications providers, and the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. At least nine organizations were compromised, and password spraying and credential scanning were run against at least 12 other high-value targets. CrowdStrike calls this an escalation from single intrusions to multiple simultaneous engagements directed by one human operator. Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) says the AI-driven attack on its network in September 2026 used ARTEX AI.
Technical Details
- Confirmed victims: telecommunications providers in the US and Belgium; government organizations in Greece, the Middle East, and Latin America; pharmaceutical firms in the US.
- In the Greek government intrusion, the agents forged an administrator token and read mailboxes using authentication keys from a 2022 mail-server directory export.
- Vapor Panda used DeepSeek and a second, unidentified commercial LLM to coordinate planning and worker agents across several intrusions at once. Operators issued instructions in Chinese and intervened at key decision points.
- The agents performed reconnaissance, exploited vulnerabilities, deployed web shells, obtained credentials, and switched to alternative attack paths when needed.
- Operators told the agents to skip Windows hosts protected by CrowdStrike Falcon and to focus on unprotected hosts.
- In one intrusion the agents consumed more than 1.4 billion input tokens, according to the researchers.
- The BLOODALCHEMY backdoor, active since 2023, was deployed against government entities in Latin America and the Middle East.
- ARTEX AI was first released as open source and later made proprietary after real-world abuse, including a campaign against South Korean financial institutions.
- DIVD says its intrusion went from initial access to root in 12 minutes by chaining a Zammad zero-day with a second zero-day for local privilege escalation. The agent read a mailbox, scanned the internal network, extracted login tokens, and attempted password resets. DIVD recorded over 450,000 requests and 2,500 scripts, describing the activity as "super loud and messy."
Remediation
The article gives no explicit remediation guidance. It implies that endpoint protection coverage matters, since operators steered agents away from Falcon-protected Windows hosts and toward unprotected ones.
-
China-nexus Vapor Panda uses ARTEX agentic AI pentesting framework to compromise ~140 sensitive targets in 11 days
ler a análise desta fonte ocultar
CrowdStrike reports that the China state-backed group it tracks as Vapor Panda is using the agentic AI penetration testing framework ARTEX, paired with DeepSeek, in an active campaign. Since Oct. 17, the group has targeted more than 200 organizations in at least 14 countries and compromised about 140 of them in 11 days. CrowdStrike says roughly 70% of targets were confirmed compromised or showed moderate-confidence evidence of intrusion. Victims and targets include foreign ministries, a European country's presidency and prime minister's office, defense and intelligence agencies, 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors, and telecom providers in the United States, Belgium and the Philippines. CrowdStrike calls this the first time it has seen an agentic nation-state adversary at this scale.
Technical Details
- ARTEX lets the operator issue requests as often as every 10 seconds and pursue multiple attack paths concurrently.
- CrowdStrike's historical hands-on-keyboard baseline was up to 40 commands per hour. With ARTEX it has seen more than 1,500 commands per hour.
- CrowdStrike describes mass exploitation of targets followed by webshell deployment (as described by CrowdStrike's Adam Meyers). The article names no specific CVEs or IOCs.
- The campaign is separate from the ARTEX activity Microsoft Threat Intelligence attributed to Storm-0940 earlier this month, which included a supply-chain attack on ConnectWise customers.
- CrowdStrike counted about 45 agentic adversary attacks in September and 126 in October, roughly threefold month-over-month growth.
Remediation
CrowdStrike's guidance is general: maintain visibility across endpoints, identities and cross-domain telemetry. The attacks use familiar techniques at unfamiliar speed and scale.
-
Vapor Panda uses AI pentest framework ARTEX against 200+ organizations worldwide; CrowdStrike also profiles four new China-nexus groups
ler a análise desta fonte ocultar
CrowdStrike attributes a campaign starting 17 October 2026 to the China-based adversary Vapor Panda (formerly VexatiousTemper, overlapping with Trend Micro's Earth Estries), which used the Go-based AI penetration testing framework ARTEX against more than 200 organizations. Targets include foreign ministries in Latin America, Europe, Asia and the Middle East, U.S. semiconductor, defense, pharmaceutical, nuclear, financial and think tank organizations, and telecommunications providers in the U.S., Belgium and the Philippines. Post-exploitation was confirmed at nine organizations, where the actor deployed BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying, network scanning and reconnaissance. At least 12 more organizations faced password-spraying and credential-scanning activity. CrowdStrike also disclosed four previously undocumented China-linked groups: Hollow Panda, Overcast Panda, Titan Panda and Veiled Panda.
Technical Details
- ARTEX orchestrates planner and worker agents backed by DeepSeek and an unidentified subscription-based commercial LLM, with a human operator steering the agents. They write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. In one intrusion the planning agents consumed about 1.4 billion input tokens.
- Observed attack chains: an unsigned SAML assertion plus an XXE flaw to query the cloud Instance Metadata Service, leading to a role able to issue commands to thousands of instances and recovery of an enterprise administrator account.
- Other chains: web shells, an unauthenticated orchestration service abused for root access in a container environment, LAPS password reads, and resource-based constrained delegation to impersonate a privileged account.
- In another case, authentication keys not rotated since 2022 were used to forge an administrator token and read mailboxes. VPN configurations from a user's sent mail and a VPN client key from a purported May 2024 email leak then gave access to the internal network.
- Agents pursued multiple paths in parallel (web apps, cloud, containers, Active Directory, mail, VPN) and switched approach when one failed.
- ARTEX's developer, Li Puhua ("Autumn-27"), took it closed source after broad adoption by threat actors. Zscaler ThreatLabz described it as lowering the technical barrier for complex intrusions.
- Overcast Panda targets people traveling to China, using close-access intrusions to deploy its proprietary FlowCloud backdoor via DLL sideloading. FlowCloud uses legitimate cloud infrastructure for C2 and supports keylogging, screen capture, file collection and credential harvesting.
- Titan Panda exploited a hard-coded IIS machine key in Intapp Time Server (ViewState deserialization) for RCE against law firms. Attacks were first detected in April 2026 and deployed the in-memory framework IceGiant. The actor is assessed as active since at least 2021, with North American legal organizations compromised for over two years.
Remediation
- Rotate long-lived authentication and signing keys, and replace default or hard-coded machine keys (including on Intapp Time Server installations).
- Validate SAML assertion signatures, fix XXE exposure and restrict access to the cloud instance metadata service.
- Detect and limit password spraying, protect LAPS passwords and review delegation settings.
- Harden VPN credentials and mailbox content hygiene.
- Apply device-handling precautions for staff traveling to China.
-
VAPOR PANDA leverages AI-driven ARTEX tooling to scale global cyber espionage campaign
ler a análise desta fonte ocultar
CrowdStrike Counter Adversary Operations reports that the China-nexus adversary VAPOR PANDA is using an AI-driven capability tracked as ARTEX to scale a global espionage campaign. The publication frames the activity as part of a broader trend of adversaries operationalizing AI to increase the speed and breadth of targeted intrusion operations, alongside CrowdStrike's related reporting on agentic AI campaigns and intensifying China-nexus activity. The retrieved page content was limited to site navigation, so technical specifics, victimology and indicators could not be extracted from this capture. Defenders tracking China-nexus espionage should consult the full CrowdStrike advisory for detection guidance.