中新网 VAPOR PANDA突破9个200Plus目标与AI Agents

网络安全

中新网 VAPOR PANDA突破9个200Plus目标与AI Agents

在 Google 上的首选来源中添加 Unite.AI

CrowdStrike 称中国内地对手VAPOR PANDA使用AI驱动的ARTEX入侵框架，主要运行在中国开发的DeepSeek大语言模型和第二个商业模型上，从2026年10月17日开始在11天的窗口中针对至少14个国家的200多个组织。 CrowdStrike 电话情报部门在2026年10月29日发表的一份报告中确认了9个组织的开采后活动。

CrowdStrike OverWatch观察到开发活动来自单一的ARTEX控制器，CrowdStrike Intelligence与VAPOR PANDA基础设施相连。 控制器定期曝光对手工具，目标文件，以及agent笔录，指向多个任务，称为框架内的任务，与多个目标相对应。 在9个经证实进行勘探后活动的组织中，敌方获得了准入权，部署了BLOODALCHEMY后门，并转入了认证喷洒、网络扫描和侦察。 对手还针对至少另外12个组织，包括设在美国的智囊团和欧洲的政府实体，开展了密码展示和认证扫描活动。

以跨区域和跨部门为目标

CrowdStrike报告说，VAPOR PANDA对设在拉丁美洲的两个国家的外交部进行了广泛的入侵，可能违反了第三个国家，并编制目标文件，供日后用于中美洲和亚洲的外交部。 对手还破坏了一个设在中东的内政部。

CrowdStrike 称一次对一个欧洲国家的介入是零的：一个欧洲国家的外交部、总统和总理办公室以及国防、司法、金融和情报实体。 另一次接触是在19个美国组织之后，这些组织跨越了制药、半导体、国防、核和金融部门。 美国，比利时和菲律宾的电信供应商也遭到破坏。

ARTEX行动内部

CrowdStrike 称 VAPOR PANDA主要使用DeepSeek模型运行ARTEX，辅以第二台基于订阅的商用LLM,CrowdStrike智能无法确认。 在一次入侵中，对手的计划agents消耗了大约14亿个输入符，一个数字CrowdStrike 称指向自动化活动的规模，意味着整个操作消耗的要多得多。

根据CrowdStrike,ARTEX将一个主agent与下级规划师和工人agents配对，共享一个事实，发现和目标的图表，将每次交战从初始准入通过宿主侦察转移到横向运动。 框架使人类处于循环之中。 已回收的文字记录显示一名操作员用中文发布指示，标记上标有“人类指示”的标签，并在中国标准时间加印时间，告诉agents创建网页壳，提取域管理员证书，检查端点传感器覆盖。

报告详述了agent在美国的两个制药组织的工作。 起初，agent将一个未署名的Security Asservation Markup Language(SAML)断言与XML外部实体(XXE)缺陷合并，以达到云实例元数据服务，获得了一个可以向上千个实例发布管理指令的作用，从那里收回了一个企业管理员账户。 第二场，agent安放网络弹壳，利用未经认证的管弦乐服务，在生产容器环境中获得根入，读取本地管理员密码解密密码，滥用基于资源的限制授权冒充特权账户。

该报告还描述了针对一个希腊政府实体的约定，其中运营商从该组织的邮件服务器上给agent一个2022目录输出，该服务器持有认证密钥可能此后从未旋转过。 agent使用这些密钥伪造管理员的令牌并读取邮箱，然后通过从用户发送的邮件中提取的VPN配置进入内部网络，操作员称的VPN客户端密钥来自2024年5月的邮件泄漏。

CrowdStrike 称在这些交往中同时追求多个攻击路径，跨越网络应用，云服务，容器环境，活动目录，以及邮件和VPN基础设施，并在路径失败时转向替代方法。 在它以前曾观察到威胁行为者利用AI agents协助个人入侵的情况下，VAPOR PANDA一次进行了几次接触，只介入决定点的agents方向。 运营商还拥有agents逃避端点防御：在一个全球性的制药组织，运营商告诉agents在域内"在没有Falcon的情况下找到Windows机器，根据任务列表和文件夹列表判断"，使用CrowdStrike为CrowdStrike Falcon传感器认定的中华人民共和国红队标语。

英国部署

CrowdStrike报告说，在设在中东的内政部和设在拉丁美洲的外交部，VAPOR PANDA部署了BLOODALCHEMY，这是2023年10月首次公开记录的后门。 对手将一个合法的GameHook二进制重新命名为svchost.exe，并用它来装入一个恶意的DLL，图形-hook-filter64.dll，这反过来解密了BLOODALCHEMY有效载荷文件图形-hook config.bin，并在已曝光的开放目录中摆出所有三个文件的副本。 植入包含一个内部项目路径，D:\Project\% Merman New\, CrowdStrike 称可能反映了恶意软件的内部开发名称。 BLOODALCHEMY与VAPOR PANDA基础设施通信，包括命令与控制域 nginxmysql.com和sqlserver-sqlite.com，指标报告称没有出现在先前公开的ARTEX报告中。

评估和建议的辩护

CrowdStrike表示，这场运动与风暴0940命名下报道的ARTEX活动行业来源不同，它认为很可能表明这个框架在多个中国内地对手中迅速获得欢迎。 自2021年起，VAPOR PANDA主要追随政府，智囊团，能源，以及欧洲，北美，大洋洲，英国的采掘组织，以建立长期准入。 报告将这场运动描述为CrowdStrike首次看到对手使用AI驱动的入侵工具，并将目标明显扩大至制药、半导体、核和国防组织以及新地区的外交部。 根据报告，该业务依赖于DeepSeek和其他商业模型，这些模型是通过专门设计的绳索运行的，可能反映出有意尝试在几个模型提供者之间建立一个具有复原力的工具链，而不是依赖一种服务。

CrowdStrike评估认为，中国内地对手极有可能在未来12个月内继续采用ARTEX等代理框架，将其与商业上可用的LLMs配对，使小团队能够同时大规模侵入许多目标。

报告建议各组织在任何疑似数据曝光后旋转签名密钥、预认证密钥和服务证书，包括存储在历史备份和目录输出中的密钥；执行 SAML 签名验证，要求 IMDSv2，并将云角色的指令执行权限限制在要求的最小范围内；在命令行参数中寻找Artx或Artex字符串，Artx前置云角色，以及 C:\ProgramData\artx5v\ 目录；补丁互联网元件，特别是长寿的 Linux 服务器；并在整个环境中部署实时端点检测和响应 agent，包括被认为无法从公共互联网获取的服务器。

本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Cybersecurity

China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents

Add Unite.AI to your preferred sources on Google

CrowdStrike said the China-nexus adversary VAPOR PANDA used the AI-driven ARTEX intrusion framework, run primarily on the Chinese-developed DeepSeek large language model and a second commercial model, to target more than 200 organizations in at least 14 countries over an 11-day window beginning October 17, 2026. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations in a report published October 29, 2026.

CrowdStrike OverWatch observed the exploitation activity coming from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. The controller periodically exposed adversary tooling, target files, and agent transcripts, pointing to multiple engagements, called tasks within the framework, running against multiple targets. At the nine organizations with confirmed post-exploitation activity, the adversary gained access, deployed the BLOODALCHEMY backdoor, and moved into credential spraying, network scanning, and reconnaissance. The adversary also ran password-spraying and credential-scanning activity against at least 12 more organizations, among them U.S.-based think tanks and government entities in Europe.

Targeting Across Regions and Sectors

CrowdStrike reported that VAPOR PANDA ran extensive intrusions inside the foreign ministries of two Latin America-based countries, likely breached a third, and staged target files for later use against foreign ministries in Central America and Asia. The adversary also compromised a Middle East-based interior ministry.

CrowdStrike said one engagement zeroed in on a single European country: its foreign ministry, presidency, and prime minister’s office, plus defense, justice, finance, and intelligence entities. Another engagement went after 19 U.S.-based organizations across the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. Telecommunications providers in the U.S., Belgium, and the Philippines were also compromised.

Inside the ARTEX Operation

CrowdStrike said VAPOR PANDA ran ARTEX primarily with the DeepSeek model, supplemented by a second, subscription-based commercial LLM that CrowdStrike Intelligence could not confirm. In a single intrusion, the adversary’s planning agents consumed roughly 1.4 billion input tokens, a figure CrowdStrike said points to the scale of the automated activity and implies the operation as a whole consumed far more.

According to CrowdStrike, ARTEX pairs a main agent with subordinate planner and worker agents that share a graph of facts, findings, and goals, moving each engagement from initial access through host reconnaissance to lateral movement. The framework kept a human in the loop. Recovered transcripts showed an operator issuing instructions in Chinese, marked with a label translated as “human instruction” and timestamped in China Standard Time, telling agents to create web shells, extract domain administrator credentials, and check endpoint sensor coverage.

The report detailed the agent’s work at two U.S.-based pharmaceutical organizations. At the first, the agent combined an unsigned Security Assertion Markup Language (SAML) assertion with an XML external entity (XXE) flaw to reach the cloud Instance Metadata Service, gaining a role that could issue administration commands to thousands of instances, and from there recovered an enterprise administrator account. At the second, the agent planted web shells, exploited an unauthenticated orchestration service to gain root access inside a production container environment, read Local Administrator Password Solution passwords, and misused resource-based constrained delegation to impersonate a privileged account.

The report also describes an engagement against a Greek government entity, in which the operator gave the agent a 2022 directory export from the organization’s mail server that held authentication keys likely never rotated since. The agent used those keys to forge an administrator token and read mailboxes, then entered the internal network through VPN configurations taken from a user’s sent mail and a VPN client key the operator said came from a May 2024 email leak.

CrowdStrike said that across these engagements the agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure, and shifted to alternative approaches when a path failed. Where it had previously observed threat actors using AI agents to assist individual intrusions, VAPOR PANDA conducted several engagements at once, stepping in only to redirect the agents at decision points. The operator also had the agents evade endpoint defenses: at a global pharmaceutical organization, the operator told the agents to “find Windows machines in the domain without Falcon, judging by tasklist and folder listings,” using what CrowdStrike identified as People’s Republic of China red-team slang for the CrowdStrike Falcon sensor.

BLOODALCHEMY Deployment

CrowdStrike reported that at a Middle East-based interior ministry and a Latin America-based foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. The adversary renamed a legitimate GameHook binary as svchost.exe and used it to load a malicious DLL, graphics-hook-filter64.dll, which in turn decrypted the BLOODALCHEMY payload file graphics-hook_config.bin, and staged copies of all three files in exposed open directories. The implant contains an internal project path, D:\ProjectX\Merman_New\, which CrowdStrike said probably reflects the malware’s in-house development name. BLOODALCHEMY communicated with VAPOR PANDA infrastructure, including the command-and-control domains nginxmysql.com and sqlserver-sqlite.com, indicators the report said do not appear in prior public ARTEX reporting.

Assessment and Recommended Defenses

CrowdStrike stated that this campaign stands apart from the ARTEX activity industry sources reported under the Storm-0940 designation, which in its view likely indicates the framework is quickly gaining popularity among multiple China-nexus adversaries. Since 2021, VAPOR PANDA has mostly gone after government, think tank, energy, and extractive organizations in Europe, North America, Oceania, and the UK in order to build long-term access. The report described this campaign as the first time CrowdStrike had seen the adversary use AI-driven intrusion tooling, and a notable expansion of its targeting into pharmaceutical, semiconductor, nuclear, and defense organizations and foreign ministries in new regions. The operation’s reliance on DeepSeek and additional commercial models, run through a purpose-built harness, likely reflects a deliberate attempt to build a resilient toolchain across several model providers instead of relying on one service, according to the report.

CrowdStrike assessed that China-nexus adversaries will highly likely keep adopting agentic frameworks such as ARTEX over the next 12 months, pairing them with commercially available LLMs and enabling small teams to scale intrusions across many targets at once.

The report recommends that organizations rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys sitting in historical backups and directory exports; enforce SAML signature validation, require IMDSv2, and limit cloud roles’ command-execution permissions to the minimum required instances; hunt for ARTEX markers such as artx or artex strings in command-line parameters, artx-prefixed cloud roles, and the C:\ProgramData\artx5v\ directory; patch internet-facing appliances, especially long-lived Linux-based servers; and deploy a real-time endpoint detection and response agent across the environment, including servers considered unreachable from the public internet.

Auto-fetched and translated by AI Atlas. All rights belong to the original author.