Vapor Panda Deploys ARTEX AI Framework in Global Espionage Campaign
Vapor Panda, a China-nexus targeted intrusion adversary tracked as VexatiousTemper since February 2021, deployed the Go-based ARTEX multi-agent AI penetration-testing framework in a global espionage campaign beginning October 17, 2026. Operators used DeepSeek and a second commercial LLM to autonomously generate and execute intrusion commands after human-defined target selection. The campaign targeted over 200 organizations across 14 countries, including government ministries, telecommunications, pharmaceutical, semiconductor, defense, nuclear, financial, and think-tank sectors. CrowdStrike confirmed at least nine compromises. Initial access relied on password-based intrusion activity and established Vapor Panda tradecraft.
QTYF Threat Group Utilizes qscan and qtrouter to Breach US Federal Agencies via IoT Botnets
The Chinese state-sponsored threat group QTYF conducted a sophisticated espionage campaign targeting the US Department of Justice, NASA, the Federal Reserve, and the US Senate. The actors deployed a global botnet of hijacked IoT devices—including routers and smart appliances—to mask their origins and provide a resilient C2 infrastructure. Using custom binaries qscan for network reconnaissance and qtrouter for traffic obfuscation and routing, QTYF successfully exfiltrated high-value national security and economic data. The operation was disrupted through FBI-led domain seizures and the neutralization of the core routing toolsets.