An update to my Vapor Panda post, with new details from BleepingComputer.
What’s new
- The campaign hit 200+ organizations in 14 countries, with password spraying and credential scanning against at least 12 more high-value targets
- At a Greek government entity, the agents forged an admin token and read mailboxes using authentication keys from a 2022 mail-server directory export
- Operators gave instructions in Chinese, stepped in at key decisions, and told the agents to skip Windows hosts running CrowdStrike Falcon
- ARTEX started as an open-source project, then went proprietary after it was used in real attacks
- DIVD says ARTEX was also behind the September attack on its network: initial access to root in 12 minutes, chaining a Zammad zero-day with a privilege-escalation zero-day, with 450,000+ requests and 2,500 scripts, “super loud and messy”
My take
That 2022 export is the lesson. Old secrets lying around become an AI agent’s skeleton key. Rotate keys, clean up old exports, and watch for noisy bursts, since these agents are loud.
God Bless, and Use the Source!
