VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign

VAPOR PANDA initiated a global espionage campaign starting October 17, 2026, leveraging the AI-driven ARTEX framework along with DeepSeek and commercial large language models to conduct simultaneous intrusions against over 200 organizations worldwide. Targets included foreign ministries in Latin America, Europe, Asia, and the Middle East, as well as U.S. semiconductor, defense, pharmaceutical, nuclear, and telecommunications sectors. The adversary deployed the BLOODALCHEMY backdoor, performed credential spraying, and directed AI agents to identify systems lacking endpoint security sensors. This campaign marks a shift from single intrusions to multiple autonomous attack paths coordinated by AI agents under human strategic guidance in Chinese. It highlights the use of open-source AI combined with commercial LLMs to scale intrusion operations beyond manual capabilities.

• SEO Poisoning Campaign Targets DeepSeek Users: Chinese Threat Actor Deploys Kong RAT via Multi-Stage AttacksMalware2026-10-29
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksMalware2026-10-23
• "Next Exploit Opportunities": How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime ActivitiesCampaign2026-10-21
• ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software VendorsMalware2026-10-22
• Inside a Global AI-Assisted Hacking CampaignMalware2026-10-22