conv.

All stories
SecurityQuiet 10d · day 13

China's Vapor Panda uses AI pentesting tool to hit 140 targets in 11 days

CrowdStrike reports a state-backed group deployed ARTEX to compromise sensitive government and corporate targets across 14 countries at unprecedented speed.

newest coverage 9d agosummary written 8d ago3 pieces NewswiresMastodonGoogle News

What to know

  • China's Vapor Panda used ARTEX agentic AI with DeepSeek to target 200+ organizations across 14 countries, achieving 70% confirmed or high-confidence intrusion rate in 11 days—hitting sensitive foreign ministries, defense agencies, and U.S. pharma/semiconductor/nuclear firms.
  • ARTEX execution reached 1,500 commands per hour versus historical 40, enabling concurrent multi-target exploitation at minimal cost; requests occurred as frequently as every 10 seconds.
  • Agentic AI malware attacks tripled month-over-month (45 in September to 126+ in October), signaling rapid normalization of autonomous AI in adversarial operations and indicating this is the first nation-state-scale deployment of its kind.

“If you diversify that across 200 targets, it costs them very little to run a mass-exploitation campaign and drop a websell. They can hit more targets in a faster period of time.”

Adam Meyers, CrowdStrike SVP Counter Adversary Operations · CyberScoop ↗

Vapor Panda China-backed threat groupCrowdStrike Cybersecurity firm and threat researcherAdam Meyers Senior Vice President, Counter Adversary Operations, CrowdStrike

China's Vapor Panda uses AI pentesting tool to hit 140 targets in 11 days
cyberscoop.com

How it unfolded 2 developments, newest first · click a bar or a number to jump articlesposts

Peak 1 piece in 3h at Oct 29, 11 PM; 3 pieces over 13 days (2 articles · 1 post) Oct 29, 11 PM — 1 piece · 1 article — Newswires 1Oct 30, 2 AM — quietOct 30, 5 AM — quietOct 30, 8 AM — quietOct 30, 11 AM — quietOct 30, 2 PM — quietOct 30, 5 PM — 1 piece · 1 post — Mastodon 1Oct 30, 8 PM — quietOct 30, 11 PM — quietOct 31, 2 AM — quietOct 31, 5 AM — quietOct 31, 8 AM — quietOct 31, 11 AM — quietOct 31, 2 PM — quietOct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — 1 piece · 1 article — Google News 1Nov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — quietNov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — quietNov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — quietNov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — quietNov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quietToday, 1 AM — quietToday, 4 AM — quietToday, 7 AM — quietToday, 10 AM — quietToday, 1 PM — quietToday, 4 PM — quietToday, 7 PM — quiet 1–2
Oct 30Oct 31Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9yesterdaynow · 8:40 PM ET
  1. 1

    CrowdStrikeAgentic AI malware attacks tripling month-over-month

    CrowdStrike reported agentic AI malware use for malicious purposes is growing almost threefold month-over-month, with 45 agentic adversary attacks observed in September and 126 already logged in October and climbing.

    “We're scrambling because we're seeing so many of these agentic adversaries.”
    — Adam Meyers, CrowdStrike
  2. 2

    CrowdStrike releases threat report detailing ARTEX campaign scale and speed

    CrowdStrike published a threat report documenting Vapor Panda's use of ARTEX with DeepSeek enabling requests as often as every 10 seconds and executing up to 1,500 commands per hour—compared to the historical 40 commands per hour from hands-on-keyboard activity tracked over 15 years.

    “This is the first time that we're seeing an agentic adversary nation-state threat actor at this scale, and I think that this is probably, unfortunately, something we'll see more of.”
    — Adam Meyers, CrowdStrike
  3. background

    Campaign reaches 140 confirmed compromises in 11 days — CrowdStrike confirmed that Vapor Panda's campaign had compromised about 140 sensitive targets with approximately 70% of the 200+ targeted organizations either confirmed compromised or showing moderate-confidence evidence of successful intrusion.

  4. background

    Vapor Panda launches ARTEX-powered campaign against 200+ organizations — China-backed threat group Vapor Panda began targeting more than 200 organizations in at least 14 countries using ARTEX, an automated agentic AI penetration testing framework paired with DeepSeek. Targets included foreign ministries, European government offices, defense and intelligence agencies, 19 U.S. organizations in pharma/semiconductors/defense/nuclear/finance, and telecom providers.