adam_cyber

Beginning on October 17, 2026, VAPOR PANDA used the ARTEX harness against more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions. This campaign detailed in the following blog post is separate from the ARTEX activity recently reported by Microsoft under the Storm-0940 designation. CrowdStrike has previously documented ARTEX and similar agentic frameworks in use by financially motivated and unattributed actors; in this campaign, a targeted intrusion adversary used ARTEX to run parallel intrusions against multiple high-value targets. This campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator. The operation also shows the adversary building endpoint sensor evasion directly into their agentic workflow, including instructions to identify hosts without the CrowdStrike Falcon sensor. crowdstrike.com/en-us/blog/v…

Threat Intelligence provides insights into the threats facing your geographic region, vertical, and even your lawyer. The latest vertical sector report looks at the legal sector which has increasingly come under fire from nation states and criminals who understand that law firms possess a wealth of sensitive client data. Intrusions targeting legal entities in 2026 have nearly doubled from the 2023 baseline. CHATTY SPIDER's activity targeting legal entities grew 129% in the first eight months of 2026 compared to all of 2024. Its tactics have expanded from callback phishing to voice phishing (vishing), remote tool abuse, and physical intrusion at U.S. law firm locations. Extortion threats escalate: Big game hunting (BGH) adversaries named 455 legal entities on dedicated leak sites from September 2025 to August 2026, a 39% increase from the prior reporting period. China-nexus espionage is evolving: Nearly twice as many China-nexus adversaries targeted the legal sector compared with 2023. Operations now include zero-day exploitation and precision targeting of executive-level personnel. Get the report for the findings you need to protect against threats to the legal sector. crowdstrike.com/en-us/resour…

CrowdStrike CAO perspective on the PHP vulnerabilities released this week - at this time, CrowdStrike Counter Adversary Operations has not observed successful exploitation of these vulnerabilities in the wild or within our honeypot environments. Additionally, we have not identified any fully weaponized exploit, or any POC exploit, sufficient to widely achieve applicable exploitation. Despite the attention PHP2Shell is receiving, only testing, probing, and unsuccessful exploitation attempts have been observed at this time. These bugs aren’t trivial to exploit, this blog provides a bit of detail on the barrier to entry: crowdstrike.com/en-us/blog/o…

CrowdStrike Counter Adversary Operations uncovered four previously unreported threat actors weaponizing AI agents in real-world intrusion campaigns, revealing a new level of speed, autonomy, and accessibility for attackers. Key findings: •AI is executing real-world intrusions: Threat actors are using AI agents across the attack life cycle, from reconnaissance to data theft. •Attacks can unfold in minutes: An AI agent moved laterally and harvested domain controller credentials in approximately 20 minutes without additional human guidance. •AI is lowering the barrier to entry: Even low-skilled attackers are using AI to compromise organizations. •AI safeguards can be bypassed: All four threat actors overcame commercial AI safety controls to enable malicious activity. Download the report to see how agentic AI is transforming real-world intrusions and what it means for defenders. r defenders. crowdstrike.com/en-us/resour…

Bringing the fight to the adversary! @Crowdstrike teamed up with @FBI to disrupt laptop farms operating across the U.S. maintained by DPRK-nexus adversary FAMOUS CHOLLIMA to fraudulently employ operatives at American companies while concealing their true location and identity. These laptop farms enabled FAMOUS CHOLLIMA operatives to pose as legitimate remote workers and siphon illicit wages back to their regime while maintaining persistent access to victim organizations. Incredible what can happen when Industry and Government work together! crowdstrike.com/en-us/blog/f…

Agentic adversaries are popping up everywhere, this is fundamentally about visibility - these aren’t novel attack paths as much as adversaries increasing speed and volume of action. This recent case in the Republic of Korea targeting financial orgs is a fascinating example: crowdstrike.com/en-us/blog/u…

This illustrates the gap between frontier and open models is closing and puts the AI safety debate into perspective - the more frontier labs slow themselves down, the more incentive there is to just swap in open-weight models. And the more those models spread, the less the labs’ controls actually work. stateofopensource.ai/

Slowing down the frontier doesn’t slow down the adversary. China is already weaponizing newly disclosed vulnerabilities within 24 hours. Now open-weight models are accelerating the adversary further. Defenders need AI that can fight AI and runtime security that can stop malicious agent activity at machine speed.

Hot off the press: @CrowdStrike 2026 Threat Hunting Report Read about detailed sector analysis, the targeting of AI, CI/CD supply chain attacks, and Close Access Operations by Chinese nexus intrusion actors. crowdstrike.com/en-us/blog/c… Incredible work by the team!