Top Highlights
- Vapor Panda used ARTEX and LLM agents to target 200+ organizations, including governments, defense firms, and telecoms.
- Nine intrusions confirmed: attackers deployed BLOODALCHEMY and pursued credentials across cloud, containers, Active Directory, email, and VPNs.
- Titan Panda exploited hard-coded IIS keys in Intapp Time for remote code execution at law firms, then used IceGiant for persistence and data theft.
Threat, Techniques, and Targets
CrowdStrike attributes the activity to Vapor Panda, a China based threat group. Starting October 17, 2026, the group used ARTEX, an AI powered penetration testing framework, against more than 200 organizations worldwide. ARTEX coordinated planner and worker agents with DeepSeek and a commercial language model. A human operator guided the agents.
Targets included government ministries, defense and intelligence organizations, telecommunications providers, and groups in the semiconductor, pharmaceutical, nuclear, financial, and think tank sectors. The group pursued attack paths across web applications, cloud services, containers, Active Directory, email, and VPN systems. Techniques included exploiting security flaws, deploying web shells, using old authentication keys, seeking administrator credentials, and scanning networks. In addition, the group used password spraying against at least 12 organizations.
Impact, Security Implications, and Remediation
CrowdStrike confirmed post exploitation activity at nine organizations. Vapor Panda deployed BLOODALCHEMY, a ShadowPad derivative, and conducted credential spraying, network scanning, and reconnaissance. ARTEX also let the group pursue multiple attack paths at once and expand the number of targets it could pursue.
Organizations should review cloud, container, identity, email, and VPN security, and check for exposed credentials and unusual account activity. The source does not provide specific remediation instructions. Organizations should obtain remediation guidance from the relevant vendor or authority.
Expand Your Tech Knowledge
Stay informed on the revolutionary breakthroughs in Quantum Computing research.
Discover archived knowledge and digital history on the Internet Archive.
ThreatIntel-V1
