Vapor Panda: Automated Cyber Espionage via ARTEX Framework

hello@craftedsignal.io — Fri, 30 Oct 2026 18:48:44 +0000

CrowdStrike has observed the threat actor Vapor Panda using a Go-based, AI-powered penetration testing framework called ARTEX to automate reconnaissance, vulnerability identification, and exploitation. The framework coordinates planner and worker agents to execute attack paths in parallel across web applications, cloud services, and Active Directory. Post-exploitation activities involve the deployment of BLOODALCHEMY, a ShadowPad derivative, followed by credential spraying and reconnaissance. Separately, the threat actor Titan Panda has been observed exploiting hard-coded machine keys in Intapp Time Server.

Intapp - CraftedSignal Threat Feed

Vapor Panda: Automated Cyber Espionage via ARTEX Framework