Threats · 1h ago
CrowdStrike says China-linked VAPOR PANDA used the ARTEX artificial-intelligence (AI) agent framework to pursue more than 200 organizations worldwide over 11 days beginning October 17; post-exploitation was confirmed at nine. At a global pharmaceutical company, the operators also had agents check whether Windows hosts ran CrowdStrike Falcon.
The agents inspected running programs and folder names—ordinary clues on a Windows machine—to identify Falcon without a special interface to the security product. That made endpoint coverage part of reconnaissance: a sensor’s presence was something the operators could discover, not a sign the host was beyond scrutiny.
For organizations with Windows fleets, Falcon deployment is not itself a measure of whether an intrusion was detected or stopped. CrowdStrike’s reporting does not say what operators did differently after finding the sensor.
3 sources covering this story
Industrial AI adoption runs ahead of cybersecurity preparedness, exposing OT environments to model manipulation and data poisoning risks.
Armed with AI, hackers target endpoint security blind spots, raising stakes for CISOs
The use of agentic AI to automate reconnaissance and exploit identity weaknesses is putting pressure on enterprise security teams to improve detection and accelerate incident response.
Artificial intelligence and cyber intrusion
An NCSC assessment that examines current AI-enabled threat trends and projections of the threat landscape to 2028.
Part of the PlainSec briefing for 2026-11-03