#bloodalchemy

November 3, 2026

Vapor Panda used ARTEX, the open-source multi-agent penetration-testing suite, against more than 200 organizations in 14 countries starting October 17, compromising at least nine and running password spraying and credential scanning against 12 other high-value targets, per CrowdStrike (BleepingComputer) (earlier coverage). Confirmed victims include telecom providers in the US and Belgium, Greek and Latin American government entities, and US pharma. Operators issued instructions in Chinese via DeepSeek plus a second unnamed commercial model, explicitly told the agents to skip Windows hosts running Falcon, and in the Greek intrusion the agents forged an admin token and read mailboxes using auth keys from a 2022 mail-server directory export. One intrusion consumed an estimated 1.4 billion input tokens. The actor also deployed the BLOODALCHEMY backdoor against Latin American and Middle Eastern government targets. Unit 42 separately reports intrusion attempts against multiple targets using ARTEX (Unit 42); @PRaSeN_S suggests a cheap detection: bursts of whoami, nltest and net group from one host within minutes, since agent-driven tooling chains discovery faster than a human types. · AI-Assisted Intrusions