{"id":1964,"date":"2026-11-02T16:54:37","date_gmt":"2026-11-02T16:54:37","guid":{"rendered":"https:\/\/www.tsfactory.com\/forums\/?p=1964"},"modified":"2026-11-02T16:54:37","modified_gmt":"2026-11-02T16:54:37","slug":"agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe","status":"publish","type":"post","link":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/","title":{"rendered":"Agentic pen-testing tool employed in multiple espionage campaigns around the globe"},"content":{"rendered":"

A China-nexus threat actor used an AI-based tool called Artex to run a sophisticated espionage campaign against multiple targets around the globe, according to a report released Thursday<\/a> by CrowdStrike.<\/p>\n

The threat actor, tracked as Vapor Panda, targeted more than 200 organizations in a total of 14 countries, in a campaign that began Oct. 17.<\/p>\n

The actor targeted foreign ministries in Latin America, Asia and Europe, as well as an interior ministry in the Middle East. The campaign also targeted 19 different organizations in the U.S., including in the pharmaceutical, defense, semiconductor, nuclear and financial sectors. Telecom firms in the U.S., Philippines and Belgium were compromised.<\/p>\n

At about nine organizations, the hackers deployed a backdoor called BloodAlchemy. After gaining access, the hackers conducted network scanning, reconnaissance and password spraying to reach internal systems. The group used password spraying and credential harvesting against 12 entities, including against U.S. think tanks and government entities in Europe.<\/p>\n

Researchers said the attackers exploited critical flaws and misconfigurations found within these systems.<\/p>\n

\u201cAt one U.S. organization, an agent exploited weaknesses in SAML authentication and XML processing to obtain cloud credentials with extensive administrative privileges,\u201d Adam Meyers, senior vice president of counter adversary operations at CrowdStrike, told Cybersecurity Dive. At another organization, an agent gained root access through an orchestration service that lacked authentication.<\/p>\n

The threat actor ran Artex alongside DeepSeek, the China-developed large language model. A second LLM was employed as well, but CrowdStrike researchers were unable to identify the specific model.<\/p>\n

Researchers also observed agents \u201cexploiting authentication keys exposed in a 2022 mail-server export, demonstrating how credentials compromised years earlier can continue to provide adversaries with access.\u201d<\/p>\n

Vapor Panda, recently tacked as Storm-0940, has been in operation since 2021, targeting government agencies, think tanks and energy sites in Europe, North America, Oceania and the U.K., according to CrowdStrike.<\/p>\n

Read the Full Story Here<\/a><\/p>\n

Source: Cybersecurity Dive<\/p>\n","protected":false},"excerpt":{"rendered":"

A China-nexus threat actor used an AI-based tool called Artex to run a sophisticated espionage campaign against multiple targets around the globe, according to a report released Thursday by CrowdStrike. The threat actor, tracked as Vapor Panda, targeted more than 200 organizations in a total of 14 countries, in a campaign that began Oct. 17. […]<\/p>\n","protected":false},"author":2,"featured_media":1261,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1964","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"yoast_head":"\nAgentic pen-testing tool employed in multiple espionage campaigns around the globe - Community<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Agentic pen-testing tool employed in multiple espionage campaigns around the globe - Community\" \/>\n<meta property=\"og:description\" content=\"A China-nexus threat actor used an AI-based tool called Artex to run a sophisticated espionage campaign against multiple targets around the globe, according to a report released Thursday by CrowdStrike. The threat actor, tracked as Vapor Panda, targeted more than 200 organizations in a total of 14 countries, in a campaign that began Oct. 17. […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/\" \/>\n<meta property=\"og:site_name\" content=\"Community\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/TSFactoryLLC\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-02T16:54:37+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2024\/05\/pexels-tara-winstead-8386440.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"853\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Chelsie Wyatt\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@TSFactoryLLC\" \/>\n<meta name=\"twitter:site\" content=\"@TSFactoryLLC\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Chelsie Wyatt\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/\",\"url\":\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/\",\"name\":\"Agentic pen-testing tool employed in multiple espionage campaigns around the globe - Community\",\"isPartOf\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2024\/05\/pexels-tara-winstead-8386440.jpg\",\"datePublished\":\"2026-11-02T16:54:37+00:00\",\"author\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/9d9908f0e12559297335ebe9b601c82f\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#primaryimage\",\"url\":\"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2024\/05\/pexels-tara-winstead-8386440.jpg\",\"contentUrl\":\"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2024\/05\/pexels-tara-winstead-8386440.jpg\",\"width\":1280,\"height\":853},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.tsfactory.com\/forums\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Agentic pen-testing tool employed in multiple espionage campaigns around the globe\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#website\",\"url\":\"https:\/\/www.tsfactory.com\/forums\/\",\"name\":\"Community\",\"description\":\"TSFactory\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.tsfactory.com\/forums\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/9d9908f0e12559297335ebe9b601c82f\",\"name\":\"Chelsie Wyatt\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/09ff3801fb7566acf715fe4e81a9bd942b923c236138a3ed8a8375f099e5d6d6?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/09ff3801fb7566acf715fe4e81a9bd942b923c236138a3ed8a8375f099e5d6d6?s=96&d=mm&r=g\",\"caption\":\"Chelsie Wyatt\"},\"url\":\"https:\/\/www.tsfactory.com\/forums\/blog\/author\/chelsie\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Agentic pen-testing tool employed in multiple espionage campaigns around the globe - Community","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/","og_locale":"en_US","og_type":"article","og_title":"Agentic pen-testing tool employed in multiple espionage campaigns around the globe - Community","og_description":"A China-nexus threat actor used an AI-based tool called Artex to run a sophisticated espionage campaign against multiple targets around the globe, according to a report released Thursday by CrowdStrike. The threat actor, tracked as Vapor Panda, targeted more than 200 organizations in a total of 14 countries, in a campaign that began Oct. 17. […]","og_url":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/","og_site_name":"Community","article_publisher":"https:\/\/www.facebook.com\/TSFactoryLLC\/","article_published_time":"2026-11-02T16:54:37+00:00","og_image":[{"width":1280,"height":853,"url":"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2024\/05\/pexels-tara-winstead-8386440.jpg","type":"image\/jpeg"}],"author":"Chelsie Wyatt","twitter_card":"summary_large_image","twitter_creator":"@TSFactoryLLC","twitter_site":"@TSFactoryLLC","twitter_misc":{"Written by":"Chelsie Wyatt","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/","url":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/","name":"Agentic pen-testing tool employed in multiple espionage campaigns around the globe - Community","isPartOf":{"@id":"https:\/\/www.tsfactory.com\/forums\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#primaryimage"},"image":{"@id":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#primaryimage"},"thumbnailUrl":"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2024\/05\/pexels-tara-winstead-8386440.jpg","datePublished":"2026-11-02T16:54:37+00:00","author":{"@id":"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/9d9908f0e12559297335ebe9b601c82f"},"breadcrumb":{"@id":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#primaryimage","url":"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2024\/05\/pexels-tara-winstead-8386440.jpg","contentUrl":"https:\/\/www.tsfactory.com\/forums\/wp-content\/uploads\/2024\/05\/pexels-tara-winstead-8386440.jpg","width":1280,"height":853},{"@type":"BreadcrumbList","@id":"https:\/\/www.tsfactory.com\/forums\/blog\/agentic-pen-testing-tool-employed-in-multiple-espionage-campaigns-around-the-globe\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.tsfactory.com\/forums\/"},{"@type":"ListItem","position":2,"name":"Agentic pen-testing tool employed in multiple espionage campaigns around the globe"}]},{"@type":"WebSite","@id":"https:\/\/www.tsfactory.com\/forums\/#website","url":"https:\/\/www.tsfactory.com\/forums\/","name":"Community","description":"TSFactory","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.tsfactory.com\/forums\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/9d9908f0e12559297335ebe9b601c82f","name":"Chelsie Wyatt","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.tsfactory.com\/forums\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/09ff3801fb7566acf715fe4e81a9bd942b923c236138a3ed8a8375f099e5d6d6?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/09ff3801fb7566acf715fe4e81a9bd942b923c236138a3ed8a8375f099e5d6d6?s=96&d=mm&r=g","caption":"Chelsie Wyatt"},"url":"https:\/\/www.tsfactory.com\/forums\/blog\/author\/chelsie\/"}]}},"_links":{"self":[{"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/posts\/1964","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/comments?post=1964"}],"version-history":[{"count":1,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/posts\/1964\/revisions"}],"predecessor-version":[{"id":1965,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/posts\/1964\/revisions\/1965"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/media\/1261"}],"wp:attachment":[{"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/media?parent=1964"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/categories?post=1964"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.tsfactory.com\/forums\/wp-json\/wp\/v2\/tags?post=1964"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}