CrowdStrike: Vapor Panda used ARTEX against over 200 organizations
From October 17 the China-linked group hit ministries, telecoms, and U.S. defense-related targets; post-exploitation is confirmed at nine.
86
- Mentions · 7d4
- Mentions · 30d21
- All mentions32
- First seenAug 21, 2026
- Last mentioned7h ago
Timeline
32 articles · newest firstMistral Large 4 ships as open weights for coding and cyber
The 1.05T model has 52B active parameters and a 1M context; Mistral's ranking claims are narrower than independent scores.
64
ONCD starts six-month rural hospital cyber pilot in South Carolina
Project Lifeline 250 offers free industry help, post-incident backup devices and replacement of high-risk legacy equipment.
40
Fake Chocolatey and Microsoft activation sites distribute ArmorSteal
Zscaler says the September campaign's Python malware also logs keystrokes, swaps wallet addresses, and checks C2 every 60 seconds.
66
Storm-0940 used AI tool Artex in ConnectWise customer intrusions
Microsoft logged more than 151,000 failed logons and successful sign-ins with ConnectWise cloud application identities.
80
Attackers exploit Citrix NetScaler RCE CVE-2026-88771
Unauthenticated attackers poison logs, plant web shells and try to run a FreeBSD implant; CISA listed the flaw.
88
Attackers exploit Citrix NetScaler RCE to deploy web shells
Unauthenticated CVE-2026-88771, scored 9.5, is used to poison logs, run commands, and drop a FreeBSD payload.
88
Microsoft links ConnectWise breach to Storm-0940 using AI tool ARTEX
Stolen application credentials were used against 2,250 Microsoft 365 tenants, with privileged access in under three hours in some cases.
82
Microsoft ties ConnectWise backup abuse to Storm-0940 and ARTEX
Sign-in attempts hit 2,900 a minute, with more than 111,000 failures on October 11 alone.
82
ARTEX-using actor expands targeting of IT and software vendors
The operator password-sprayed engineers, tested unsigned JWTs, and probed cross-tenant access on Okta, Entra ID and Cognito.
76
Storm-0940 used ARTEX and AI coding agents against many targets
Microsoft says the group tried more than 2,250 tenants at about 2,900 sign-ins a minute.
74
Storm-0940 used ARTEX against over 2,250 Microsoft 365 tenants
Stolen ConnectWise application credentials enabled Graph access; a separate spray of more than 151,000 logons had no successful authentication.
76
PHP core flaws allow unauthenticated remote code execution
CVE-2026-109618 and CVE-2026-109619, called PHP2Shell, each score CVSS 9.2; emergency patches are out.
78
Zscaler says ransomware crews use generative AI for custom malware
An October 16 analysis describes faster script changes, stronger phishing and quicker data discovery, with no named family or indicators.
46
Zscaler says ransomware gangs use AI to select data for extortion
ThreatLabz cites 896.2 TB stolen by the top 10 groups and a healthcare payment of $2 million with no encryption.
58
CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability
Attackers are actively exploiting critical unauthenticated NetScaler RCE CVE-2026-88771, now listed in CISA's KEV catalog.
86
Threat Actor Abuses Agentic AI Pentesting Framework to Target South Korean Financial Institutions
A threat actor used the ARTEX agentic pentest framework to steal financial PII from South Korean institutions.
76
Hackers Abuse Trusted Terraform Workflows to Infect Developer Systems With Cross-Platform Malware
A trojanized Terraform AWS provider installs FLATROOF and ROOFDECK malware on developer macOS, Linux, and Windows systems.
76
Suspected TraderTraitor Hackers Trojanize Terraform Provider to Deploy Cross-Platform Malware
Suspected North Korean hackers trojanized a Terraform provider to install FLATROOF and ROOFDECK on developer machines.
76
New 2CLoader Malware Evades Security Tools to Deploy Vidar and Remus Stealers
Zscaler found 2CLoader, a Windows loader delivering Vidar, Remus, and XWorm while evading analysis.
58
New 2CLoader Malware Uses Anti-VM and API Hooking to Deliver Vidar and Remus Stealers
Zscaler details 2CLoader, a Windows loader using anti-VM checks and API hooks to deploy Vidar and Remus.
64
2CLoader: A New Malware Loader Delivering Vidar and Remus
Zscaler details 2CLoader, a new malware loader that delivers the Vidar and Remus payloads.
63
Threat Actors Use Google Ads To Target Ledger Users
Attackers used malicious Google ads to phish Ledger users for cryptocurrency recovery phrases.
71
Vidar Malware Rewrites Its Obfuscation With Every Build to Make Detection Harder
Vidar infostealer rewrites its string obfuscation on every build using custom virtual machines and stream ciphers, blunting static detection of the credential thief.
42
Vidar Uses Custom Bytecode Interpreter and ARX Stream Ciphers for Per-Build String Obfuscation
Vidar stealer now hides strings with a custom bytecode VM and per-build ARX stream ciphers, weakening static detection.
58
Vidar Adds Virtual Machine and Custom Stream Ciphers For String Obfuscation
ThreatLabz shows Vidar 2.x and 3.x hide strings with a bytecode virtual machine and custom stream cipher.
58
APT36 Uses USB-Spreading Malware to Reach Air-Gapped Government Networks
Zscaler attributes the RapidRust campaign by Pakistan-linked APT36 to USB-propagating Rust malware targeting air-gapped government networks in India and Afghanistan.
78
Hackers Deploy New SloppyRAT via ClickFix to Enable Ransomware Lateral Movement
Zscaler discovered SloppyRAT, a ClickFix-delivered RAT that gives ransomware operators reconnaissance, remote execution, and SOCKS proxy pivoting for lateral movement.
52
Top 10 Best Browser Isolation Solutions in 2026
A 2026 market overview ranks ten remote browser isolation tools, with Menlo Security as the pure-play reference as SSE vendors bundle isolation.
12
Zscaler Agentic SOC combines AI agents with zero trust telemetry
Zscaler launched Agentic SOC, an AI-agent-driven security operations platform combining zero trust telemetry with frontier models from Anthropic and OpenAI.
32
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
62
Suspected Russian Hackers Abuse Google OAuth and WhatsApp Linking to Hijack Accounts
Google tracked three suspected Russian espionage clusters abusing OAuth flows, app passwords, and WhatsApp linking to hijack accounts of diplomats and defense targets.
72
Related CVEs
by mentions- CVE-2026-8877182%9.5Unauthenticated RCE in Citrix NetScaler ADC and Gateway
- CVE-2026-756504%10.0Unauthenticated Template Injection RCE in Adobe Commerce and Magento (CVE-2026-75650)
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-1074062%9.5Memory overflow RCE/DoS in NetScaler ADC and Gateway
Appears with
- Microsoftvendor · 7
- Zscalervendor · 7
- Storm-0940threat actor · 6
- Vidarmalware · 5
- Microsoft 365product · 5
- ARTEXmalware · 5
- CrowdStrikeorganization · 4
- ConnectWisevendor · 4
- NetScaler ADCproduct · 3
- Recorded Futureorganization · 3
- Microsoftorganization · 3
- GLMai model · 3
- Grokai model · 3
- NetScaler Gatewayproduct · 3
- Artexproduct · 3
- Remusmalware · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.