A China-nexus threat actor used an AI-based tool called Artex to run a sophisticated espionage campaign against multiple targets around the globe, according to a report released Thursday by CrowdStrike.
The threat actor, tracked as Vapor Panda, targeted more than 200 organizations in a total of 14 countries, in a campaign that began Oct. 17.
The actor targeted foreign ministries in Latin America, Asia and Europe, as well as an interior ministry in the Middle East. The campaign also targeted 19 different organizations in the U.S., including in the pharmaceutical, defense, semiconductor, nuclear and financial sectors. Telecom firms in the U.S., Philippines and Belgium were compromised.
At about nine organizations, the hackers deployed a backdoor called BloodAlchemy. After gaining access, the hackers conducted network scanning, reconnaissance and password spraying to reach internal systems. The group used password spraying and credential harvesting against 12 entities, including against U.S. think tanks and government entities in Europe.
Researchers said the attackers exploited critical flaws and misconfigurations found within these systems.
“At one U.S. organization, an agent exploited weaknesses in SAML authentication and XML processing to obtain cloud credentials with extensive administrative privileges,” Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told Cybersecurity Dive. At another organization, an agent gained root access through an orchestration service that lacked authentication.
The threat actor ran Artex alongside DeepSeek, the China-developed large language model. A second LLM was employed as well, but CrowdStrike researchers were unable to identify the specific model.
Researchers also observed agents “exploiting authentication keys exposed in a 2022 mail-server export, demonstrating how credentials compromised years earlier can continue to provide adversaries with access.”
Vapor Panda, recently tacked as Storm-0940, has been in operation since 2021, targeting government agencies, think tanks and energy sites in Europe, North America, Oceania and the U.K., according to CrowdStrike.
Source: Cybersecurity Dive