China-linked group uses AI to target endpoint security
Original title: Armed with AI, hackers target endpoint security blind spots, raising stakes for CISOs
VAPOR PANDA targeted over 200 organizations with ARTEX AI agents in 11 days, confirming post-exploitation at nine sites.
A China-linked hacking group tracked as VAPOR PANDA used an AI-powered penetration testing framework called ARTEX to target more than 200 organizations worldwide over an 11-day period. The attackers instructed AI agents to examine running processes and folder listings on Windows machines to determine whether CrowdStrike’s Falcon sensor was installed. The findings follow an October 21 report from Microsoft detailing a separate campaign involving ARTEX used by Storm-0940.
- VAPOR PANDA targeted more than 200 organizations across at least 14 countries
- Researchers confirmed post-exploitation at nine organizations
- ARTEX uses multiple AI agents under human direction
Impact: Endpoint access and cloud role privileges
- 1.Ensure endpoint protection coverage
- 2.Rotate credentials
- 3.Enforce SAML signature validation
- Vendors
- CrowdStrikeMicrosoft
- Threat actors
- VAPOR PANDAStorm-0940
- Organizations
- HFS ResearchOmdiaKanerika
- Countries
- 14
- AI models
- DeepSeek
From the original article
4 min read at csoonline.com
A China-linked hacking group’s use of AI agents to identify security weaknesses during a global espionage campaign is raising concerns about whether enterprises can detect gaps in their defenses before automated attacks exploit them.
csoonline.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.