Mike Kearn

Beginning on October 17, 2026, VAPOR PANDA used the ARTEX harness against more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions. This campaign detailed in the following blog post is separate from the ARTEX activity recently reported by Microsoft under the Storm-0940 designation. CrowdStrike has previously documented ARTEX and similar agentic frameworks in use by financially motivated and unattributed actors; in this campaign, a targeted intrusion adversary used ARTEX to run parallel intrusions against multiple high-value targets. This campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator. The operation also shows the adversary building endpoint sensor evasion directly into their agentic workflow, including instructions to identify hosts without the CrowdStrike Falcon sensor. crowdstrike.com/en-us/blog/v…

Threat Intelligence provides insights into the threats facing your geographic region, vertical, and even your lawyer. The latest vertical sector report looks at the legal sector which has increasingly come under fire from nation states and criminals who understand that law firms possess a wealth of sensitive client data. Intrusions targeting legal entities in 2026 have nearly doubled from the 2023 baseline. CHATTY SPIDER's activity targeting legal entities grew 129% in the first eight months of 2026 compared to all of 2024. Its tactics have expanded from callback phishing to voice phishing (vishing), remote tool abuse, and physical intrusion at U.S. law firm locations. Extortion threats escalate: Big game hunting (BGH) adversaries named 455 legal entities on dedicated leak sites from September 2025 to August 2026, a 39% increase from the prior reporting period. China-nexus espionage is evolving: Nearly twice as many China-nexus adversaries targeted the legal sector compared with 2023. Operations now include zero-day exploitation and precision targeting of executive-level personnel. Get the report for the findings you need to protect against threats to the legal sector. crowdstrike.com/en-us/resour…

CrowdStrike Counter Adversary Operations uncovered four previously unreported threat actors weaponizing AI agents in real-world intrusion campaigns, revealing a new level of speed, autonomy, and accessibility for attackers. Key findings: •AI is executing real-world intrusions: Threat actors are using AI agents across the attack life cycle, from reconnaissance to data theft. •Attacks can unfold in minutes: An AI agent moved laterally and harvested domain controller credentials in approximately 20 minutes without additional human guidance. •AI is lowering the barrier to entry: Even low-skilled attackers are using AI to compromise organizations. •AI safeguards can be bypassed: All four threat actors overcame commercial AI safety controls to enable malicious activity. Download the report to see how agentic AI is transforming real-world intrusions and what it means for defenders. r defenders. crowdstrike.com/en-us/resour…

Bringing the fight to the adversary! @Crowdstrike teamed up with @FBI to disrupt laptop farms operating across the U.S. maintained by DPRK-nexus adversary FAMOUS CHOLLIMA to fraudulently employ operatives at American companies while concealing their true location and identity. These laptop farms enabled FAMOUS CHOLLIMA operatives to pose as legitimate remote workers and siphon illicit wages back to their regime while maintaining persistent access to victim organizations. Incredible what can happen when Industry and Government work together! crowdstrike.com/en-us/blog/f…