VAPOR PANDA launched a global espionage campaign on October 17, 2026, using the AI-driven ARTEX framework combined with DeepSeek and commercial large language models to conduct simultaneous intrusions against over 200 organizations worldwide. Targets included foreign ministries across Latin America, Europe, Asia, and the Middle East, as well as critical U.S. sectors such as semiconductor, defense, pharmaceutical, nuclear, and telecommunications. The adversary deployed the BLOODALCHEMY backdoor, performed credential spraying, and used AI agents to identify systems lacking endpoint security sensors. This campaign represents a shift to multiple autonomous attack paths coordinated by AI under human strategic guidance in Chinese, scaling intrusion operations beyond manual capabilities.
An Akira ransomware affiliate gained initial access through an exposed SonicWall VPN without multi-factor authentication via credential spraying. After compromising the domain controller, the attacker performed Active Directory enumeration, collected and exfiltrated data using WinRAR and s5cmd to cloud storage. The affiliate employed a novel evasion technique by rebooting the victim host into Safe Mode with Networking to disable EDR and antivirus protection. AnyDesk was installed as a persistent remote access mechanism. However, the Safe Mode environment caused the ransomware to fail due to out-of-virtual-memory errors, preventing encryption. Despite the encryption failure, the attacker had already exfiltrated credentials and file shares, enabling extortion through data leak threats. This marks the first observed instance of Akira affiliates using Safe Mode boot as an anti-EDR technique.
