中新网 VAPOR PANDA出击以AI Agents突破了9个200Plus目标。

网络安全

中新网 VAPOR PANDA出击以AI Agents突破了9个200Plus目标。

在 Google 上的首选来源中添加 Unite.AI

CrowdStrike 称中国内地对手VAPOR PANDA使用AI驱动的ARTEX入侵框架，主要运行在中国开发的DeepSeek大语言模型和第二个商业模型上，在2026年10月17日开始的11天窗口中，针对至少14个国家的200多个组织。 CrowdStrike 坐标情报部门在2026年10月29日发表的一份报告中确认了9个组织的开采后活动。

CrowdStrike OverWatch观察到开采活动来自单一的ARTEX控制器，CrowdStrike Intelligence与VAPOR PANDA基础设施相连接。 控制器定期曝光对手工具，目标文件，和agent记录，指向多个任务，称为框架内的任务，与多个目标相撞。 在9个已证实有开采后活动的组织中，敌方获得了准入权，部署了BLOODALCHEMY后门，并转入证书喷洒、网络扫描和侦察。 对手还针对至少另外12个组织，包括设在美国的智囊团和欧洲的政府实体，开展了密码展示和认证扫描活动。

以跨区域和部门为目标

CrowdStrike报告说，VAPOR PANDA对设在拉丁美洲的两个国家的外交部进行广泛的入侵，可能违反三分之一，并编制目标文件，供日后用于中美洲和亚洲的外交部。 对手还破坏了一个设在中东的内政部。

CrowdStrike 称 1次参与对一个欧洲国家：外交部、总统和总理办公室，以及国防、司法、金融和情报实体。 另一次接触是在19个美国组织之后进行的，这些组织涉及制药、半导体、国防、核和金融部门。 美国，比利时，菲律宾的电信供应商也受到了破坏。

ARTEX行动内部

CrowdStrike 称 VAPOR PANDA主要使用DeepSeek模型运行ARTEX，并辅以第二台基于订阅的商用LLM,CrowdStrike智能无法确认。 在一次入侵中，对手的计划agents消耗了大约14亿个输入令牌，一个数字CrowdStrike 称指向了自动化活动的规模，意味着整个操作消耗的要多得多。

根据CrowdStrike,ARTEX与下级规划师和工人agents对一主agent，他们共享一个事实，发现，以及目标的图，将每次交战从初始准入通过宿主侦察向横向移动。 框架使人类处于循环之中。 回收的笔录显示一名操作员以中文发布指令，并标有被译为"人用指令"并被印入"中国标准时间"的标签，告诉agents创建网页贝壳，提取域管理员证书，并检查端点传感器覆盖。

报告详述了agent在美国的两个制药组织的工作。 一开始，agent将一个未署名的Security Asservation Markup Language(SAML)断言与XML外部实体(XXE)缺陷合并，以通到"云中元数据服务"，获得了一个可以向上千个实例发布管理指令的角色，从那里收回了一个企业管理员账户。 在第二起事件中，agent放置了网络弹壳，利用一种未经认证的管弦乐服务，在生产容器环境中获得根入，读取"本地管理员密码解决方案"密码，并滥用基于资源的限制授权来冒充一个特权账户。

该报告还描述了针对一个希腊政府实体的约定，其中运营商从该组织的邮件服务器中向agent提供了2022个目录输出，该邮件服务器持有认证密钥可能此后从未旋转过。 agent使用这些密钥来伪造管理员的令牌并读取邮箱，然后通过取自用户所发邮件的VPN配置进入内部网络，操作员称的VPN客户端密钥出自2024年5月的一通电子邮件出漏。

CrowdStrike 称在这些交往中平行地追求多个攻击路径，跨越了网络应用，云服务，容器环境，活性目录，以及邮件和VPN基础设施，并在路径失败时转向了其他方法。 在它以前曾观察到威胁行为者利用AI agents协助个人入侵的情况下，VAPOR PANDA一次进行了几次接触，只是在决定点进入agents方向。 运营商还有agents逃避端点防御：在一个全球性的制药组织，运营商告诉agents"在没有Falcon的情况下在域中找到Windows机器，根据任务列表和文件夹列表判断"，使用CrowdStrike为CrowdStrike Falcon传感器所认定的中华人民共和国红队口号。

英国部署

CrowdStrike报告说，在设在中东的一个内政部和设在拉丁美洲的一个外交部，VAPOR PANDA部署了BLOODALCHEMY，这是2023年10月首次公开记录的后门。 对手将一个合法的GameHook 二进制重命名为 svchost.exe 并用它来加载一个恶意的 DLL，图形-hook-filter64.dll，这反过来又解密了 BLOODALCHEMY 有效载荷文件图形-hook config.bin，并在被曝光的开放目录中摆出所有三个文件的副本。 植入包含一个内部项目路径，D:\Project\% Merman New\, CrowdStrike 称可能反映了恶意软件的内部开发名称。 BLOODALCHEMY与VAPOR PANDA基础设施通信，包括命令与控制域 nginxmysql.com 和 sqlserver-sqlite.com，指标报告称没有出现在此前公开的ARTEX报告中。

评估和建议辩护

CrowdStrike表示，这场运动与 " 风暴0940 " 命名下报道的ARTEX活动行业来源不同，它认为可能表明该框架在多个中国内地对手中迅速得到欢迎。 自2021年起，VAPOR PANDA主要追随政府，智囊团，能源，以及欧洲，北美，大洋洲，英国等地的采掘组织，以建立长期准入。 报告将这场运动描述为CrowdStrike首次看到对手使用AI驱动的入侵工具，并将目标明显地扩大到新区域的制药、半导体、核和国防组织以及外交部。 行动依靠DeepSeek和其他商业模式，通过专门制造的绳索运行，可能反映出有人有意试图在若干模式提供者之间建立一个具有复原力的工具链，而不是根据报告依赖一种服务。

CrowdStrike评估认为，中国内地对手极有可能在未来12个月内继续采用ARTEX等代理框架，将其与可商业获取的LLMs配对，使小型团队能够同时对许多目标进行大规模入侵。

报告建议各组织在任何疑似数据曝光后旋转签名密钥、预先认证密钥和服务证书，包括存储在历史备份中的密钥和目录输出；执行 SAML 签名验证，要求 IMDSv2，并将云角色的指令执行权限限制在要求的最小范围内；在命令行参数、Artx前置云角色和C:\ProgramData\artx5v\目录中搜索ArTEX标记；补丁互联网设备，特别是长寿的Linux服务器；在环境中部署实时端点检测和响应agent，包括被认为无法从公共互联网获取的服务器。

本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。

Cybersecurity

China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents

Add Unite.AI to your preferred sources on Google

CrowdStrike said the China-nexus adversary VAPOR PANDA used the AI-driven ARTEX intrusion framework, run primarily on the Chinese-developed DeepSeek large language model and a second commercial model, to target more than 200 organizations in at least 14 countries over an 11-day window beginning October 17, 2026. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations in a report published October 29, 2026.

CrowdStrike OverWatch observed the exploitation activity coming from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. The controller periodically exposed adversary tooling, target files, and agent transcripts, pointing to multiple engagements, called tasks within the framework, running against multiple targets. At the nine organizations with confirmed post-exploitation activity, the adversary gained access, deployed the BLOODALCHEMY backdoor, and moved into credential spraying, network scanning, and reconnaissance. The adversary also ran password-spraying and credential-scanning activity against at least 12 more organizations, among them U.S.-based think tanks and government entities in Europe.

Targeting Across Regions and Sectors

CrowdStrike reported that VAPOR PANDA ran extensive intrusions inside the foreign ministries of two Latin America-based countries, likely breached a third, and staged target files for later use against foreign ministries in Central America and Asia. The adversary also compromised a Middle East-based interior ministry.

CrowdStrike said one engagement zeroed in on a single European country: its foreign ministry, presidency, and prime minister’s office, plus defense, justice, finance, and intelligence entities. Another engagement went after 19 U.S.-based organizations across the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. Telecommunications providers in the U.S., Belgium, and the Philippines were also compromised.

Inside the ARTEX Operation

CrowdStrike said VAPOR PANDA ran ARTEX primarily with the DeepSeek model, supplemented by a second, subscription-based commercial LLM that CrowdStrike Intelligence could not confirm. In a single intrusion, the adversary’s planning agents consumed roughly 1.4 billion input tokens, a figure CrowdStrike said points to the scale of the automated activity and implies the operation as a whole consumed far more.

According to CrowdStrike, ARTEX pairs a main agent with subordinate planner and worker agents that share a graph of facts, findings, and goals, moving each engagement from initial access through host reconnaissance to lateral movement. The framework kept a human in the loop. Recovered transcripts showed an operator issuing instructions in Chinese, marked with a label translated as “human instruction” and timestamped in China Standard Time, telling agents to create web shells, extract domain administrator credentials, and check endpoint sensor coverage.

The report detailed the agent’s work at two U.S.-based pharmaceutical organizations. At the first, the agent combined an unsigned Security Assertion Markup Language (SAML) assertion with an XML external entity (XXE) flaw to reach the cloud Instance Metadata Service, gaining a role that could issue administration commands to thousands of instances, and from there recovered an enterprise administrator account. At the second, the agent planted web shells, exploited an unauthenticated orchestration service to gain root access inside a production container environment, read Local Administrator Password Solution passwords, and misused resource-based constrained delegation to impersonate a privileged account.

The report also describes an engagement against a Greek government entity, in which the operator gave the agent a 2022 directory export from the organization’s mail server that held authentication keys likely never rotated since. The agent used those keys to forge an administrator token and read mailboxes, then entered the internal network through VPN configurations taken from a user’s sent mail and a VPN client key the operator said came from a May 2024 email leak.

CrowdStrike said that across these engagements the agents pursued multiple attack paths in parallel, spanning web applications, cloud services, container environments, Active Directory, and mail and VPN infrastructure, and shifted to alternative approaches when a path failed. Where it had previously observed threat actors using AI agents to assist individual intrusions, VAPOR PANDA conducted several engagements at once, stepping in only to redirect the agents at decision points. The operator also had the agents evade endpoint defenses: at a global pharmaceutical organization, the operator told the agents to “find Windows machines in the domain without Falcon, judging by tasklist and folder listings,” using what CrowdStrike identified as People’s Republic of China red-team slang for the CrowdStrike Falcon sensor.

BLOODALCHEMY Deployment

CrowdStrike reported that at a Middle East-based interior ministry and a Latin America-based foreign ministry, VAPOR PANDA deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023. The adversary renamed a legitimate GameHook binary as svchost.exe and used it to load a malicious DLL, graphics-hook-filter64.dll, which in turn decrypted the BLOODALCHEMY payload file graphics-hook_config.bin, and staged copies of all three files in exposed open directories. The implant contains an internal project path, D:\ProjectX\Merman_New\, which CrowdStrike said probably reflects the malware’s in-house development name. BLOODALCHEMY communicated with VAPOR PANDA infrastructure, including the command-and-control domains nginxmysql.com and sqlserver-sqlite.com, indicators the report said do not appear in prior public ARTEX reporting.

Assessment and Recommended Defenses

CrowdStrike stated that this campaign stands apart from the ARTEX activity industry sources reported under the Storm-0940 designation, which in its view likely indicates the framework is quickly gaining popularity among multiple China-nexus adversaries. Since 2021, VAPOR PANDA has mostly gone after government, think tank, energy, and extractive organizations in Europe, North America, Oceania, and the UK in order to build long-term access. The report described this campaign as the first time CrowdStrike had seen the adversary use AI-driven intrusion tooling, and a notable expansion of its targeting into pharmaceutical, semiconductor, nuclear, and defense organizations and foreign ministries in new regions. The operation’s reliance on DeepSeek and additional commercial models, run through a purpose-built harness, likely reflects a deliberate attempt to build a resilient toolchain across several model providers instead of relying on one service, according to the report.

CrowdStrike assessed that China-nexus adversaries will highly likely keep adopting agentic frameworks such as ARTEX over the next 12 months, pairing them with commercially available LLMs and enabling small teams to scale intrusions across many targets at once.

The report recommends that organizations rotate signing keys, preauthentication keys, and service credentials after any suspected data exposure, including keys sitting in historical backups and directory exports; enforce SAML signature validation, require IMDSv2, and limit cloud roles’ command-execution permissions to the minimum required instances; hunt for ARTEX markers such as artx or artex strings in command-line parameters, artx-prefixed cloud roles, and the C:\ProgramData\artx5v\ directory; patch internet-facing appliances, especially long-lived Linux-based servers; and deploy a real-time endpoint detection and response agent across the environment, including servers considered unreachable from the public internet.

Auto-fetched and translated by AI Gem Box. All rights belong to the original author.