An AI offensive agent breached WorkOS' internal sales app - hunt its user agents in your logs. https://intel.threadlinqs.com/threat/TL-2026-5179?utm_source=bluesky #ThreatIntel #BloodAlchemy #ARTEX #Claude
November 3, 2026 at 10:05 PM
An AI offensive agent breached WorkOS' internal sales app - hunt its user agents in your logs. https://intel.threadlinqs.com/threat/TL-2026-5179?utm_source=bluesky #ThreatIntel #BloodAlchemy #ARTEX #Claude
China-nexus crews put an AI agent framework, ARTEX, on intrusion duty: cloud admin in under 3 hours. https://intel.threadlinqs.com/threat/TL-2026-5196?utm_source=bluesky #ThreatIntel #BloodAlchemy #ARTEX #Chisel
November 4, 2026 at 1:40 AM
China-nexus crews put an AI agent framework, ARTEX, on intrusion duty: cloud admin in under 3 hours. https://intel.threadlinqs.com/threat/TL-2026-5196?utm_source=bluesky #ThreatIntel #BloodAlchemy #ARTEX #Chisel
~Malpedia~
Chinese state group Vapor Panda uses AI-powered ARTEX framework to automate parallel intrusions against 200+ organizations, deploying BLOODALCHEMY and abusing cloud, AD, and VPN...
-
IOCs: (None identified)
-
#AISecurity #Backdoor #CyberEspionage #ThreatIntel
Chinese state group Vapor Panda uses AI-powered ARTEX framework to automate parallel intrusions against 200+ organizations, deploying BLOODALCHEMY and abusing cloud, AD, and VPN...
-
IOCs: (None identified)
-
#AISecurity #Backdoor #CyberEspionage #ThreatIntel
Link
malpedia.caad.fkie.fraunhofer.de
November 4, 2026 at 5:06 PM
~Malpedia~
Chinese state group Vapor Panda uses AI-powered ARTEX framework to automate parallel intrusions against 200+ organizations, deploying BLOODALCHEMY and abusing cloud, AD, and VPN...
-
IOCs: (None identified)
-
#AISecurity #Backdoor #CyberEspionage #ThreatIntel
Chinese state group Vapor Panda uses AI-powered ARTEX framework to automate parallel intrusions against 200+ organizations, deploying BLOODALCHEMY and abusing cloud, AD, and VPN...
-
IOCs: (None identified)
-
#AISecurity #Backdoor #CyberEspionage #ThreatIntel
China-nexus operators now let multi-agent AI plan the intrusion. ARTEX turns spraying into a speedrun. https://intel.threadlinqs.com/threat/TL-2026-5152?utm_source=bluesky #ThreatIntel #BloodAlchemy #MimiKatz #Storm
November 3, 2026 at 1:00 PM
China-nexus operators now let multi-agent AI plan the intrusion. ARTEX turns spraying into a speedrun. https://intel.threadlinqs.com/threat/TL-2026-5152?utm_source=bluesky #ThreatIntel #BloodAlchemy #MimiKatz #Storm
~Checkpoint~
Major crypto thefts, AI-enabled espionage, Yoba malware, and KeyDrift campaigns target global organizations.
-
IOCs: Yoba, KeyDrift, BLOODALCHEMY
-
#Malware #Ransomware #ThreatIntel
Major crypto thefts, AI-enabled espionage, Yoba malware, and KeyDrift campaigns target global organizations.
-
IOCs: Yoba, KeyDrift, BLOODALCHEMY
-
#Malware #Ransomware #ThreatIntel
Weekly Threat Intelligence Report
research.checkpoint.com
November 2, 2026 at 5:05 PM
~Checkpoint~
Major crypto thefts, AI-enabled espionage, Yoba malware, and KeyDrift campaigns target global organizations.
-
IOCs: Yoba, KeyDrift, BLOODALCHEMY
-
#Malware #Ransomware #ThreatIntel
Major crypto thefts, AI-enabled espionage, Yoba malware, and KeyDrift campaigns target global organizations.
-
IOCs: Yoba, KeyDrift, BLOODALCHEMY
-
#Malware #Ransomware #ThreatIntel
at nine confirmed victims the adversary deployed bloodalchemy, a shadowpad derivative, for persistent access. crowdstrike first identified the adversary in february 2021, and trend micro's earth estries activity cluster overlaps with crowdstrike's findings.
November 3, 2026 at 2:37 AM
at nine confirmed victims the adversary deployed bloodalchemy, a shadowpad derivative, for persistent access. crowdstrike first identified the adversary in february 2021, and trend micro's earth estries activity cluster overlaps with crowdstrike's findings.
BloodAlchemy hides in a signed Brother binary, then Early Bird injects into system processes. https://intel.threadlinqs.com/threat/TL-2026-4846?utm_source=bluesky #ThreatIntel #BloodAlchemy #SNAPPYBEE #ShadowPad
October 30, 2026 at 6:27 PM
BloodAlchemy hides in a signed Brother binary, then Early Bird injects into system processes. https://intel.threadlinqs.com/threat/TL-2026-4846?utm_source=bluesky #ThreatIntel #BloodAlchemy #SNAPPYBEE #ShadowPad
CrowdStrike exposed the VAPOR PANDA ARTEX campaign using AI agents to breach over 200 targets, combining the VAPOR PANDA ARTEX toolset with DeepSeek.
#VAPORPANDA #ARTEX #CrowdStrike #CyberEspionage #DeepSeek #BLOODALCHEMY #Cybersecurity
#VAPORPANDA #ARTEX #CrowdStrike #CyberEspionage #DeepSeek #BLOODALCHEMY #Cybersecurity
VAPOR PANDA Deploys ARTEX AI Agents to Attack Over 200 Targets
TL;DR CrowdStrike identified a major cyber espionage push called the VAPOR PANDA ARTEX campaign targeting over 200 global entities. The adversary ran the ARTEX framework alongside DeepSeek language models to conduct multiple parallel network intrusions. Consequently, human operators intervened only at critical decision points while deploying the custom BLOODALCHEMY backdoor. What Happened in the Campaign Beginning on October 17, 2026, security analysts tracked attacks launched from a single central controller.
meterpreter.org
November 2, 2026 at 1:53 AM
CrowdStrike exposed the VAPOR PANDA ARTEX campaign using AI agents to breach over 200 targets, combining the VAPOR PANDA ARTEX toolset with DeepSeek.
#VAPORPANDA #ARTEX #CrowdStrike #CyberEspionage #DeepSeek #BLOODALCHEMY #Cybersecurity
#VAPORPANDA #ARTEX #CrowdStrike #CyberEspionage #DeepSeek #BLOODALCHEMY #Cybersecurity
Where campaign indicators match, correlate controller/C2 activity with BLOODALCHEMY evidence across investigations; establish actual access separately. Contain as needed. ARTEX alone is not attribution: CrowdStrike distinguishes this campaign from Storm-0940.
October 30, 2026 at 6:51 PM
Where campaign indicators match, correlate controller/C2 activity with BLOODALCHEMY evidence across investigations; establish actual access separately. Contain as needed. ARTEX alone is not attribution: CrowdStrike distinguishes this campaign from Storm-0940.
Vapor Panda used ARTEX, a Go-based AI penetration-testing framework, to target 200+ organizations worldwide and conduct post-exploitation with BLOODALCHEMY and credential attacks.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
October 30, 2026 at 6:26 PM
Vapor Panda used ARTEX, a Go-based AI penetration-testing framework, to target 200+ organizations worldwide and conduct post-exploitation with BLOODALCHEMY and credential attacks.
Vapor Panda used ARTEX, a Go-based AI penetration-testing framework, to target 200+ organizations worldwide and conduct post-exploitation with BLOODALCHEMY and credential attacks.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
October 30, 2026 at 6:26 PM
Vapor Panda used ARTEX, a Go-based AI penetration-testing framework, to target 200+ organizations worldwide and conduct post-exploitation with BLOODALCHEMY and credential attacks.
Vapor Panda used ARTEX, a Go-based AI penetration-testing framework, to target 200+ organizations worldwide and conduct post-exploitation with BLOODALCHEMY and credential attacks.
Save What Matters
Curate Feeds | Make Collections | Customize Email Briefs
briefly.co
October 30, 2026 at 6:26 PM
Vapor Panda used ARTEX, a Go-based AI penetration-testing framework, to target 200+ organizations worldwide and conduct post-exploitation with BLOODALCHEMY and credential attacks.
🚨 Chinese state-sponsored hackers used AI-powered ARTEX to target over 200 organizations worldwide.
CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware.
Full story: thehackernews.com/2026/10/chin...
CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware.
Full story: thehackernews.com/2026/10/chin...
Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide
China-linked Vapor Panda used ARTEX AI agents to target over 200 organizations, with post-exploitation activity confirmed at nine.
thehackernews.com
October 30, 2026 at 5:17 PM
🚨 Chinese state-sponsored hackers used AI-powered ARTEX to target over 200 organizations worldwide.
CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware.
Full story: thehackernews.com/2026/10/chin...
CrowdStrike confirms post-exploitation at nine, including deployment of BLOODALCHEMY malware.
Full story: thehackernews.com/2026/10/chin...
@crowdstrike.com
ARTEX and DeepSeek enabled parallel intrusions against 200+ organizations, deploying BLOODALCHEMY.
-
IOCs: nginxmysql[.]com, sqlserver-sqlite[.]com, 45[.]153[.]126[.]223
-
#Malware #ThreatIntel #VAPORPANDA
ARTEX and DeepSeek enabled parallel intrusions against 200+ organizations, deploying BLOODALCHEMY.
-
IOCs: nginxmysql[.]com, sqlserver-sqlite[.]com, 45[.]153[.]126[.]223
-
#Malware #ThreatIntel #VAPORPANDA
VAPOR PANDA Scales AI Espionage
www.crowdstrike.com
October 30, 2026 at 4:04 AM
@crowdstrike.com
ARTEX and DeepSeek enabled parallel intrusions against 200+ organizations, deploying BLOODALCHEMY.
-
IOCs: nginxmysql[.]com, sqlserver-sqlite[.]com, 45[.]153[.]126[.]223
-
#Malware #ThreatIntel #VAPORPANDA
ARTEX and DeepSeek enabled parallel intrusions against 200+ organizations, deploying BLOODALCHEMY.
-
IOCs: nginxmysql[.]com, sqlserver-sqlite[.]com, 45[.]153[.]126[.]223
-
#Malware #ThreatIntel #VAPORPANDA
🤖 CrowdStrike: China-linked Vapor Panda used ARTEX, a Go/LLM pentest framework, against 200+ orgs. AI agents chained SAML forgery + XXE to cloud IMDS; 9 confirmed intrusions, BLOODALCHEMY dropped.
https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html
https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html
October 30, 2026 at 7:55 PM
🤖 CrowdStrike: China-linked Vapor Panda used ARTEX, a Go/LLM pentest framework, against 200+ orgs. AI agents chained SAML forgery + XXE to cloud IMDS; 9 confirmed intrusions, BLOODALCHEMY dropped.
https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html
https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html
VAPOR PANDA's AI agents hunt for hosts with no EDR sensor, then run intrusions in parallel. https://intel.threadlinqs.com/threat/TL-2026-4779?utm_source=bluesky #ThreatIntel #BloodAlchemy #ARTEX #Chisel
October 29, 2026 at 11:30 PM
VAPOR PANDA's AI agents hunt for hosts with no EDR sensor, then run intrusions in parallel. https://intel.threadlinqs.com/threat/TL-2026-4779?utm_source=bluesky #ThreatIntel #BloodAlchemy #ARTEX #Chisel
CrowdStrike reports VAPOR PANDA used ARTEX with DeepSeek and another LLM for parallel intrusions against 200+ organizations; it confirmed post-exploitation at nine and BLOODALCHEMY deployment at two ministries, with endpoint-sensor evasion built into workflows.
VAPOR PANDA Uses ARTEX and LLMs to Scale Global Espionage Campaign
CrowdStrike reports VAPOR PANDA used ARTEX with DeepSeek and another LLM for parallel intrusions against 200+ organizations; it confirmed post-exploitation…
cyber.hendryadrian.com
October 30, 2026 at 12:00 PM
CrowdStrike reports VAPOR PANDA used ARTEX with DeepSeek and another LLM for parallel intrusions against 200+ organizations; it confirmed post-exploitation at nine and BLOODALCHEMY deployment at two ministries, with endpoint-sensor evasion built into workflows.
This tweet appeared under this Techmeme headline:
@cyber_o51nt:
VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/...
@cyber_o51nt:
VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/...
October 30, 2026 at 6:04 AM
This tweet appeared under this Techmeme headline:
@cyber_o51nt:
VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/...
@cyber_o51nt:
VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/...
China-nexus VAPOR PANDA used the ARTEX agent framework against more than 200 organisations from 17 October.
https://cyber-threat.net/vapor-panda-artex-espionage-campaign/
https://cyber-threat.net/vapor-panda-artex-espionage-campaign/
VAPOR PANDA scales espionage with ARTEX agents
China-nexus VAPOR PANDA used the ARTEX agent framework against more than 200 organisations from 17 October. Nine saw BLOODALCHEMY post-exploitation.
cyber-threat.net
October 31, 2026 at 10:46 AM
China-nexus VAPOR PANDA used the ARTEX agent framework against more than 200 organisations from 17 October.
https://cyber-threat.net/vapor-panda-artex-espionage-campaign/
https://cyber-threat.net/vapor-panda-artex-espionage-campaign/
This tweet appeared under this Techmeme headline:
@cyber_o51nt:
VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/...
@cyber_o51nt:
VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/...
October 30, 2026 at 6:04 AM
This tweet appeared under this Techmeme headline:
@cyber_o51nt:
VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/...
@cyber_o51nt:
VAPOR PANDA used ARTEX and AI models to conduct simultaneous espionage intrusions against more than 200 organizations worldwide, deploying BLOODALCHEMY and checking for unprotected hosts. https://www.crowdstrike.com/...
CrowdStrike称，与中国有关联的组织VAPOR PANDA在11天内利用AI智能体攻击了至少14个国家的逾200家机构，其中9起入侵事件得到确认。
#VAPORPANDA #AI智能体 #ARTEX #DeepSeek #网络间谍活动 #BLOODALCHEMY
[AI]
#VAPORPANDA #AI智能体 #ARTEX #DeepSeek #网络间谍活动 #BLOODALCHEMY
[AI]
CrowdStrike称VAPOR PANDA利用AI智能体攻击逾200家机构
CrowdStrike称，与中国有关联的VAPOR PANDA利用AI智能体，在至少14个国家攻击了逾200家机构；其中9起入侵事件得到确认。
harava.news
October 30, 2026 at 12:14 PM
CrowdStrike称，与中国有关联的组织VAPOR PANDA在11天内利用AI智能体攻击了至少14个国家的逾200家机构，其中9起入侵事件得到确认。
#VAPORPANDA #AI智能体 #ARTEX #DeepSeek #网络间谍活动 #BLOODALCHEMY
[AI]
#VAPORPANDA #AI智能体 #ARTEX #DeepSeek #网络间谍活动 #BLOODALCHEMY
[AI]
CrowdStrike says Vapor Panda used AI-powered ARTEX against more than 200 organizations from Oct. 17, 2026. Post-exploitation was confirmed at nine, where attackers deployed BLOODALCHEMY; the article also describes other China-linked groups.
CrowdStrike Says Vapor Panda Used AI-Powered ARTEX Against 200+ Organizations
CrowdStrike says Vapor Panda used AI-powered ARTEX against more than 200 organizations from Oct. 17, 2026. Post-exploitation was confirmed at nine, where…
cyber.hendryadrian.com
October 30, 2026 at 10:48 PM
CrowdStrike says Vapor Panda used AI-powered ARTEX against more than 200 organizations from Oct. 17, 2026. Post-exploitation was confirmed at nine, where attackers deployed BLOODALCHEMY; the article also describes other China-linked groups.
CrowdStrike says the China-linked group VAPOR PANDA used AI agents to target more than 200 organizations in at least 14 countries over 11 days, with intrusions confirmed at nine.
#VAPORPANDA #AIAgents #ARTEX #DeepSeek #CyberEspionage #BLOODALCHEMY
[AI]
#VAPORPANDA #AIAgents #ARTEX #DeepSeek #CyberEspionage #BLOODALCHEMY
[AI]
CrowdStrike Says VAPOR PANDA Used AI Agents to Target More Than 200 Organizations
CrowdStrike says China-linked VAPOR PANDA used AI agents to target more than 200 organizations in at least 14 countries; nine intrusions were confirmed.
harava.news
October 30, 2026 at 12:14 PM
CrowdStrike says the China-linked group VAPOR PANDA used AI agents to target more than 200 organizations in at least 14 countries over 11 days, with intrusions confirmed at nine.
#VAPORPANDA #AIAgents #ARTEX #DeepSeek #CyberEspionage #BLOODALCHEMY
[AI]
#VAPORPANDA #AIAgents #ARTEX #DeepSeek #CyberEspionage #BLOODALCHEMY
[AI]
CrowdStrike uppger att den Kina-kopplade gruppen VAPOR PANDA använde AI-agenter för att rikta in sig på över 200 organisationer i minst 14 länder under 11 dagar, med intrång bekräftade hos nio.
#VAPORPANDA #AIAgenter #ARTEX #DeepSeek #Cyberespionage #BLOODALCHEMY
[AI]
#VAPORPANDA #AIAgenter #ARTEX #DeepSeek #Cyberespionage #BLOODALCHEMY
[AI]
CrowdStrike uppger att VAPOR PANDA använde AI-agenter för att rikta in sig på över 200 organisationer
CrowdStrike uppger att den Kina-kopplade gruppen VAPOR PANDA använde AI-agenter för att rikta in sig på över 200 organisationer i minst 14 länder; intrång bekräftades hos nio.
harava.news
October 30, 2026 at 12:14 PM
CrowdStrike uppger att den Kina-kopplade gruppen VAPOR PANDA använde AI-agenter för att rikta in sig på över 200 organisationer i minst 14 länder under 11 dagar, med intrång bekräftade hos nio.
#VAPORPANDA #AIAgenter #ARTEX #DeepSeek #Cyberespionage #BLOODALCHEMY
[AI]
#VAPORPANDA #AIAgenter #ARTEX #DeepSeek #Cyberespionage #BLOODALCHEMY
[AI]
CrowdStrike afirma que el grupo VAPOR PANDA, vinculado a China, utilizó agentes de IA para atacar a más de 200 organizaciones en al menos 14 países durante 11 días, y que se confirmaron intrusiones en nueve.
#VAPORPANDA #AgentesDeIA #ARTEX #DeepSeek #Ciberespionaje #BLOODALCHEMY
[AI]
#VAPORPANDA #AgentesDeIA #ARTEX #DeepSeek #Ciberespionaje #BLOODALCHEMY
[AI]
CrowdStrike afirma que VAPOR PANDA utilizó agentes de IA para atacar a más de 200 organizaciones
CrowdStrike afirma que VAPOR PANDA, un grupo vinculado a China, utilizó agentes de IA para atacar a más de 200 organizaciones en al menos 14 países; se confirmaron intrusiones en nueve.
harava.news
October 30, 2026 at 12:14 PM
CrowdStrike afirma que el grupo VAPOR PANDA, vinculado a China, utilizó agentes de IA para atacar a más de 200 organizaciones en al menos 14 países durante 11 días, y que se confirmaron intrusiones en nueve.
#VAPORPANDA #AgentesDeIA #ARTEX #DeepSeek #Ciberespionaje #BLOODALCHEMY
[AI]
#VAPORPANDA #AgentesDeIA #ARTEX #DeepSeek #Ciberespionaje #BLOODALCHEMY
[AI]