Vapor Panda: Automated Cyber Espionage via ARTEX Framework
Vapor Panda (formerly VexatiousTemper, overlapping with Earth Estries) is utilizing the AI-powered ARTEX framework to conduct large-scale, concurrent, multi-vector intrusions targeting over 200 global organizations, including foreign ministries, telecommunications, and defense sectors.
Triage facts
Revision 1- Applicability
- Intapp Time Server
- Evidence
- Confirmed activeHigh confidence
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 18:48 UTC
- Source quality
- D2Likely
CrowdStrike has observed the threat actor Vapor Panda using a Go-based, AI-powered penetration testing framework called ARTEX to automate reconnaissance, vulnerability identification, and exploitation. The framework coordinates planner and worker agents to execute attack paths in parallel across web applications, cloud services, and Active Directory. Post-exploitation activities involve the deployment of BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying and reconnaissance. Separately, the threat actor Titan Panda has been observed exploiting hard-coded machine keys in Intapp Time Server.