VAPOR PANDA

VAPOR PANDA is a China-nexus cyberespionage threat actor active since at least 2021. It targets government agencies, think tanks, energy and extractive organizations, telecommunications providers, and strategically important industries to establish long-term access. Its geographic reach includes Europe, North America, Oceania, Asia, Latin America, and the Middle East. Identified targets include organizations in the United States, United Kingdom, Greece, Belgium, and the Philippines. Beginning October 17, 2026, VAPOR PANDA used the ARTEX agentic framework against more than 200 organizations across at least 14 countries, with confirmed post-exploitation activity at nine organizations. Targets included foreign and interior ministries, other senior government institutions, and pharmaceutical, semiconductor, defense, nuclear, and financial organizations. The operation combined DeepSeek and another commercial large language model with human-directed planning and worker agents to pursue simultaneous intrusion paths, conduct reconnaissance, obtain initial access, and move laterally. This campaign marked its first observed use of AI-driven intrusion tooling. VAPOR PANDA's techniques include password spraying, network scanning, credential theft, web-shell deployment, exploitation of application and identity weaknesses, cloud administration abuse, and privilege escalation through resource-based constrained delegation. It has forged authentication tokens using exposed signing material, accessed government mailboxes, and reused VPN material recovered from email to enter internal networks. Operators have directed reconnaissance toward systems without endpoint protection and used anonymization, proxying, and tunneling tools to conceal access. The group also deploys the BLOODALCHEMY backdoor through DLL sideloading using a legitimate GameHook executable. Its ARTEX activity is distinct from activity attributed to Storm-0940.