Agent-Driven Intrusions Get Named Operators, and a Kernel Bug Gets Mass-Scanned

A China-nexus actor ran the ARTEX agentic pentest framework against 200+ organizations in 14 countries with a human supervising in Chinese, and Kaspersky published what it calls one of the first in-the-wild compromises driven by an LLM-orchestrated C2. Internet-wide scanning has begun for the 9.8-rated Linux kernel MPTCP use-after-free, and European supermarket refrigeration was remotely defrosted for the second time in a month.

AI-Assisted Intrusions

• Vapor Panda used ARTEX, the open-source multi-agent penetration-testing suite, against more than 200 organizations in 14 countries starting October 17, compromising at least nine and running password spraying and credential scanning against 12 other high-value targets, per CrowdStrike (BleepingComputer) (earlier coverage). Confirmed victims include telecom providers in the US and Belgium, Greek and Latin American government entities, and US pharma. Operators issued instructions in Chinese via DeepSeek plus a second unnamed commercial model, explicitly told the agents to skip Windows hosts running Falcon, and in the Greek intrusion the agents forged an admin token and read mailboxes using auth keys from a 2022 mail-server directory export. One intrusion consumed an estimated 1.4 billion input tokens. The actor also deployed the BLOODALCHEMY backdoor against Latin American and Middle Eastern government targets. Unit 42 separately reports intrusion attempts against multiple targets using ARTEX (Unit 42); @PRaSeN_S suggests a cheap detection: bursts of whoami, nltest and net group from one host within minutes, since agent-driven tooling chains discovery faster than a human types.
• DIVD, the Dutch Institute for Vulnerability Disclosure, says its September 2026 breach went from initial access to root in 12 minutes, chaining a Zammad zero-day with a second zero-day for local privilege escalation (BleepingComputer). WorkOS also notified customers of an October 30 incident it attributes to ARTEX-driven activity, detected as anomalous traffic to an internal business system at 16:39 UTC (Hacker News).
• Kaspersky documented the CyberStrikeAI framework in the wild against education-sector organizations in Africa and Latin America — an LLM orchestrator on the C2 plans actions and generates commands while a Go implant executes them, taking attackers from recon to full domain compromise in roughly three to four days (Securelist). The practical takeaway for defenders: the implant itself is not AI-driven, so classic behavioral detections and C2 indicators still work. Attribution is supported by Go build metadata — Windows and Linux samples share identical build info, splitting the set into two groups — and by per-C2 implant tokens embedded at build time that double as network indicators.
• Mandiant quantified LLMJacking, the hijacking of enterprise LLM access across cloud and model providers, in incidents spanning North America, South America and APAC in financial services, retail, tech and transportation (Google Cloud). Individual incidents produced fraudulent charges exceeding $100,000 in a single day, with cumulative charges at some organizations reaching $1 million before access was revoked. GTIG is tracking a division of labor between initial-access actors and “LLM Mixers” — illicit routing gateways that proxy, aggregate and resell unauthorized model access to underground subscribers (discussion).
• VOLTA-AUTODOXER is a Windows infostealer that feeds a structured victim dossier through OpenRouter to rank stolen data by monetization value, defaulting to Claude Opus 4.6 and falling back through Kimi K2 and Gemini 2.5 Flash when it detects refusal phrases like “I can’t” (The Hacker News). Its 240-word system prompt casts the model as a “forensic intelligence analyst” and demands sections titled “WHAT THEY’RE WORTH” and “THEIR OPSEC.”

Vulnerabilities & Exploitation

• Scanning has started for CVE-2026-98432, the Linux kernel use-after-free in the multipath TCP handshake path. MalwareTech reports detecting what appears to be threat-actor activity scanning the entire internet for exposed affected systems (MalwareTech) (earlier coverage). The bug triggers when a response to a retransmitted SYN races connection establishment in another thread, allowing kernel memory disclosure or an attacker-controlled overflow; one LWN commenter notes they built a crash PoC in about an hour with Claude (LWN). Go enables MPTCP by default, widening exposure considerably; sysctl -w net.mptcp.enabled=0 is the stopgap where kernels can’t be patched. Ubuntu has fixes in the -proposed pocket (Ubuntu).
• Shadowserver still sees over 1,000 internet-facing GitLab instances unpatched against CVE-2026-97229 (CVSS 10.0), an integer overflow in the CI/CD Regular Expression Compiler that gives unauthenticated RCE via a crafted regex in a pipeline config (BleepingComputer). Separately it tracks over 11,300 instances vulnerable to CVE-2026-110264, out of roughly 39,000 GitLab instances seen daily.
• Ivanti Connect Secure: Volexity attributes the chain to UTA0576, which gained unauthenticated root on an appliance running 22.8R2.4 beginning October 3 (Rapid7) (earlier coverage). CVE-2026-111357 (local authenticated privilege escalation) and CVE-2026-118527 (remote authenticated file upload to a known path) chain with the authentication bypass CVE-2026-104935; both were added to KEV on October 30. Fixed in 25.1.1.3 and 22.8R2.6 — Rapid7 recommends post-patch compromise hunting, and NCSC-NL has raised the advisory to high/high (NCSC-NL).
• Siemens IoT2050 devices are being exploited via a maximum-severity flaw in a widely used OT programming tool to plant remote-command backdoors delivering Linux malware (The Register, The Hacker News).
• BTCPay Server instances on 2.4.1 or earlier are having Bitcoin and Litecoin drained from hot wallets, using a different exploitation method against the flaw patched in August’s 2.4.2 (BTCPay Server, The Hacker News). The project’s guidance is blunt: patching alone may not evict an intruder — move to a fresh server with a new wallet and seed, sweep remaining funds, and rotate exposed credentials.
• Synology is urging DSM updates after a surge of C3RB3R ransomware attacks against NAS devices running outdated versions of a patched flaw (Synology, BleepingComputer).
• Langflow, the open-source AI agent/workflow builder, has two critical flaws allowing unauthenticated auth bypass or arbitrary code execution, per IBM, affecting every release from 1.0.0 through 1.12.8 with 1.13.0 the only fix; neither is currently in KEV (The Hacker News).
• HPE advisory HPESBNW05162 (October 22) fixes 72 vulnerabilities in ArubaOS, including eight CVSS 10.0 unauthenticated RCE and auth-bypass flaws (CVE-2026-79844 through CVE-2026-79851) across AOS-8 and AOS-10 running on Mobility Conductors, Controllers, Gateways and APs (HPE).

New Tools & Releases

• tprtdll-Injection demonstrates EDR unhooking using tprtdll.dll, a Microsoft-signed DLL shipped in System32 on Windows 11 build 26100+ that exports its own copies of many Nt*/Zw*/Rtl* syscall stubs at independent virtual addresses — resolving them via GetProcAddress sidesteps inline hooks placed on ntdll.dll (GitHub). The repo maps which stubs are present

✎ This issue was written by claude-opus-5. No human edited it before publishing — how this works .