Vapor Panda Used ARTEX AI in Attacks Targeting More Than 200 Organizations
Summary
CrowdStrike says Vapor Panda used ARTEX AI and language models to target over 200 organizations in 14 countries, compromising at least nine. Separately, DIVD attributed a September attack on its network to ARTEX AI.
Key points
- The operation began October 17 and targeted government, telecom, pharmaceutical, semiconductor, defense, nuclear, and financial organizations across 14 countries.
- CrowdStrike says at least nine organizations were compromised, while password spraying and credential scanning targeted at least 12 others.
- In an attack on a Greek government entity, agents reportedly forged an administrator token and accessed mailboxes using authentication keys from a 2022 mail-server directory export.
- The agents used ARTEX AI alongside DeepSeek and an unidentified commercial language model for reconnaissance, vulnerability exploitation, web-shell deployment, credential gathering, and coordinating multiple intrusions.
- Operators instructed agents to avoid Windows machines protected by CrowdStrike Falcon; CrowdStrike estimates one intrusion consumed more than 1.4 billion input tokens.
- CrowdStrike also found BLOODALCHEMY deployed against government entities in Latin America and the Middle East.
- DIVD says an ARTEX AI agent reached root privileges in 12 minutes by chaining two zero-days and generated over 450,000 requests and 2,500 scripts.
Article Details
- Event Type
- AI-assisted cyberespionage campaign using the ARTEX penetration-testing framework
- Impact
- CrowdStrike researchers report that Vapor Panda targeted more than 200 organizations across 14 countries, compromised at least nine, and conducted password spraying and credential scanning against at least 12 other high-value targets. Targets included government, telecommunications, pharmaceutical, semiconductor, defense, nuclear, and financial organizations. Confirmed victims included telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and U.S. pharmaceutical firms. The attackers reportedly deployed the BLOODALCHEMY backdoor against government entities in Latin America and the Middle East. Separately, DIVD reported an ARTEX AI attack against its network that reached root privileges in 12 minutes.
MITRE ATT&CK
T1046 · Network Service DiscoveryThe AI agent scanned the internal network during the reported DIVD attack.T1068 · Exploitation for Privilege EscalationIn the DIVD attack, the agent chained a zero-day vulnerability for local privilege escalation.T1110.003 · Password SprayingThe attackers conducted password spraying against high-value targets.T1505.003 · Web ShellThe AI agents deployed web shells during the campaign.
Threat Actors
Malware
Vendors
Products
DeepSeekIn its most recent cyberespionage operation, Vapor Panda also used DeepSeek and a second, unidentified commercial language model to coordinate planning and worker agents across multiple intrusions simultaneously.FalconThe operators explicitly instructed the agents to skip Windows machines protected by Falcon, CrowdStrike's solution for endpoint protection, and focused on unprotected hosts.ZammadDIVD explained in a post on LinkedIn that the attack went from initial access to root privileges in 12 minutes, chaining a Zammad zero-day with a second zero-day for local privilege escalation.
Tools
Countries
BelgiumConfirmed victims include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the U.S.GreeceConfirmed victims include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the U.S.United StatesConfirmed victims include telecommunications providers in the United States and Belgium, government organizations in Greece, the Middle East, and Latin America, and pharmaceutical firms in the U.S.
Industries
DefenseThe operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.financialThe operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.GovernmentThe operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.nuclearThe operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.pharmaceuticalThe operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.semiconductorThe operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.TelecommunicationsThe operation began on October 17 and targeted government ministries, telecommunications providers, and organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors.