Vapor Panda used agentic AI tool ARTEX against about 140 targets
CrowdStrike says the China-linked campaign has hit more than 200 organizations in at least 14 countries since October 17.
84
AI model
DeepSeek
- Mentions · 7d12
- Mentions · 30d36
- All mentions69
- First seenAug 18, 2026
- Last mentioned12h ago
Timeline
69 articles · newest firstn0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
74
CrowdStrike: Vapor Panda used ARTEX against over 200 organizations
From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.
86
Suspected Chinese actor roots PAN-OS firewalls via chained PHP2Shell
The chain rooted 25 servers in four countries and reached a US government Active Directory domain, Unit 42 says.
86
Attackers chain PHP2Shell with Fragnesia kernel bug for root
Dream Security says the chain rooted Palo Alto firewalls and reached Active Directory on 25 servers, three tied to the US government.
84
Reports say PHP2Shell bugs were exploited, including on firewalls
GreyNoise reports at least six successful hits; Dream claims 24 firewalls and two US-linked servers were compromised.
84
Suspected Chinese attackers rooted 25 servers with custom PHP2Shell chain
The chain hit PAN-OS 12.1 and 12.2 from October 23; Dream says remote access likely remains.
84
ClinGeX agent lifts concordance on held-out clinical genomic cases
On 223 held-out cases it reached 71.7% task concordance versus 45.7% for the strongest comparator.
46
Chained PHP2Shell exploit roots 25 firewalls, including US government systems
Dream says a custom PHP2Shell build plus the Fragnesia kernel bug yielded unauthenticated root and Active Directory access.
78
Attackers chain PHP2Shell and kernel exploits for root on 25 servers
Dream says custom exploits for CVE-2026-109618, CVE-2026-109619 and CVE-2026-46300 reached government-affiliated firewalls and Active Directory.
76
PHP2Shell campaign roots 25 servers, including U.S. government-linked hosts
Dream says a custom exploit plus a Linux kernel bug rooted firewalls in the U.S., Japan, Taiwan, and South Korea.
86
Component translation does not reliably change LLM refusal rates
On 190 harmful behaviours, only an exploratory Mistral Small 4 Spanish swap stayed significant after correction.
42
Swedish government offices block ChatGPT and Claude on work computers
Staff must use approved tools such as Copilot, while some keep access through an internal assistant platform.
54
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
82
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
76
China demands the US lift its federal DeepSeek removal order
The order also covers other vendors' software built on DeepSeek models and bars future federal purchases.
62
DHS orders DeepSeek removed from federal civilian systems
The July 24 order, published October 20, also covers third-party tools and services built with DeepSeek implementations.
76
China defends DeepSeek after US ban on civilian agency systems
Homeland Security told civilian agencies to remove DeepSeek products and stop procuring them, citing China-based servers.
64
NVIDIA details local AI hardware lineup at GTC Berlin
DGX Spark 64GB systems start shipping October 23, eight-unit clusters are supported, and Windows DGX Station is due in December.
58
DHS bars DeepSeek from U.S. civilian agency systems
The order also blocks procurement of third-party products and services built with DeepSeek technology.
68
US orders civilian agencies to remove DeepSeek from systems
The DHS order also covers third-party products built with DeepSeek technology, with exceptions available on request.
74
DHS orders civilian agencies to remove DeepSeek from IT systems
The October 20 notice also blocks future buys and third-party products built on DeepSeek, but not private use.
74
DHS bans DeepSeek technology across US federal civilian agencies
Agencies must remove existing DeepSeek products and cannot buy new ones, including affiliated and third-party implementations.
74
TAG-217’s South Korea bank operation exposed its own tools
Open directories showed crypto, Linux and mobile tooling; cited breaches cover at least 68,000 people.
72
DHS orders civilian agencies to stop buying and remove DeepSeek
The October 2026 supply-chain order covers affiliates and third-party products, not private DeepSeek use.
74
AI-agent campaign breached websites at more than 100 companies
NorForge tracked campaign AIA0001 across 14 dashboards; Deere, SharkNinja and Cummins were named.
78
Tenstorrent raises $1.5 billion at a $6.2 billion valuation
The inference-chip startup will scale hardware for open-weight models after showing Galaxy servers running DeepSeek.
48
DHS bans DeepSeek from US civilian federal agencies
Agencies must remove existing copies and exclude future purchases, with exceptions requiring 60 days' notice.
74
TAG-217 used Claude, DeepSeek and Grok against South Korean banks
Cited reporting says at least 68,000 people's data was exposed at seven or more financial institutions.
73
Hackers Use Codex and DeepSeek AI Agents to Breach 440 PaperCut Servers Worldwide
Attackers used Codex and DeepSeek agents to exploit PaperCut flaws and compromise 440 servers in 48 countries.
82
Hackers Use Hundreds of AI Agents to Exploit PaperCut Servers and Steal Windows Credentials
A threat actor used AI agents to exploit PaperCut, compromising about 440 servers and stealing Windows credentials.
88
Stolen AI API keys are paying for hackers’ autonomous scans
Bitsight says criminals sell MONST3R-AI, which uses stolen AI API keys to fund autonomous scans.
64
TAG-217 Targets South Korean Financial Services with ARTEX
TAG-217 used the ARTEX AI framework in attacks that exposed data on 68,000 people at South Korean banks.
74
Few people pay for AI, but those who do spend big
Andreessen Horowitz says only 4.5% of US consumers pay for major AI chatbots, while top spenders average about $900 monthly.
46
Microsoft event debuts new AI-friendly hardware and Windows changes
Microsoft launched the Surface Laptop Ultra and RTX Spark Dev Box with Windows 11 local AI and agent controls.
72
The EDR blind spot: 3 ways browser attacks evade endpoint telemetry
NordLayer argues browser-based SaaS attacks, including AiTM phishing and malicious extensions, often evade traditional EDR.
34
Researchers Discover Cybercrime Server Containing AI Tools, Phishing Kits and Stolen Data
Researchers found an exposed French cybercrime server holding GHOST C2, phishing kits, AI agents, and over 16,000 stolen credentials.
73
Stolen AI credentials feed growing LLM proxy economy
Team Cymru estimates more than 80,000 proxy servers hide stolen AI credentials and enable model distillation.
74
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
74
CLOSEDQUORUM, the malware that asks four AI models what to do next
Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.
74
Related CVEs
by mentions- CVE-2026-8207861%9.4Unsafe Reflection RCE in PaperCut NG/MF, Chained with Auth Bypass in Attacks
- CVE-2026-8157884%8.8Missing Authentication for Critical Function in PaperCut NG/MF Web Interface
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-4630016%7.8Shared-frag marker loss in Linux kernel skb coalescing (LPE)
- CVE-2021-4227873%7.5Privilege Escalation via sAMAccountName Spoofing in Microsoft Active Directory
- CVE-2021-4228777%7.5Privilege Escalation in Microsoft Active Directory Domain Services
- CVE-2026-425306%9.2NGINX Open Source has a vulnerability in the ngx_http_v3_module module
- CVE-2026-3382477%9.8Unauthenticated Double-Free RCE in Microsoft Windows IKE Extension
- CVE-2026-598002%9.29Router before 0.4.44 contains an OS command injection vulnerability in the unauthenticated POST /api/tunnel/tailscale-install endpoint (this route is not…
Appears with
- DeepSeekvendor · 19
- Geminiai model · 15
- OpenAIvendor · 15
- Qwenai model · 13
- Claudeai model · 12
- GreyNoiseorganization · 11
- PaperCutvendor · 11
- Mistralai model · 10
- Microsoftvendor · 9
- ClosedQuorummalware · 9
- Cisco Talosorganization · 9
- Googlevendor · 9
- CISAorganization · 8
- Anthropicvendor · 8
- Kimiai model · 8
- PaperCut MFproduct · 8
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.