Strategic PartnersIssue 042 records
CrowdStrike
A quiet weekend edition, run as a backfill. CrowdStrike published nothing new between its Oct 30 posts and Nov 2 Fal.Con Europe news, so the edition turns to independent views of the ARTEX agentic attack tooling at the center of CrowdStrike's VAPOR PANDA reporting. Google/Mandiant report ARTEX and similar frameworks in real intrusions affecting U.S. government and other sectors, fast but forensically noisy and sometimes blocked. AhnLab found attack tooling in exposed ARTEX directories but could confirm only attempts, and argues that presence, execution, success and attribution must be judged separately. Neither verifies CrowdStrike's victim figures.
- Evidence records
- 2
- Cross-source patterns
- 1
- Evidence classes
- 2 independent research
- Outcomes
- 2 cautionary
- Source freshness
- 2 new this fortnight
- Research completed
- 2026-11-03
Choose a role to see its takeaway beside every record in the ledger.
Patterns across the evidence
Synthesis · Lighthouse Advisory interpretation
Independent researchers confirm ARTEX is used in real intrusions, but stress noise and unconfirmed success
Two vendors independent of CrowdStrike now describe ARTEX in real attacks. Google/Mandiant saw it in incident-response cases affecting U.S. government and other sectors, running in bursts of seconds but leaving noisy logs, and in one case blocked by endpoint protection. AhnLab found attack tooling in exposed ARTEX directories but could confirm only an attempted Pass-the-Hash login, not success or attribution. Together they support CrowdStrike's warning that agentic tools are in active use, while neither verifies CrowdStrike's VAPOR PANDA attribution or victim figures.
Operating questionDoes the agency's telemetry show machine-speed bursts across identity, cloud and endpoints, and do its reports separate attempted, confirmed and attributed compromise?
Supporting evidenceGoogle Threat Intelligence Group (GTIG) and MandiantAhnLab Security Intelligence Center (ASEC)
Evidence ledger
Full record · every source keeps its link and limitations
Google Threat Intelligence Group and Mandiant: ARTEX and Friends — agentic offensive frameworks observed in incident response
GTIG and Mandiant report that since late August 2026 several threat actors have run ARTEX, PentAGI, CAIRN and custom harnesses during real intrusions they responded to, affecting U.S. government, technology, chemicals and manufacturing organizations. ARTEX ran in bursts of about 2 to 25 seconds (27 events in 23 seconds in one case), but it was 'far more forensically noisy' than a skilled human: one attempt produced 240 log events, and in one case endpoint protection blocked lateral movement. GTIG judges current use early-stage and 'broad and noisy, but still successful'. Why now: this is the first non-CrowdStrike, incident-response view of the ARTEX activity that CrowdStrike's Oct 29 VAPOR PANDA report centers on, while the Oct 31 edition found that every VAPOR PANDA figure rested on CrowdStrike alone.
Why it matters, evidence and limitations
- Why it matters
- Direct for state and local agencies: GTIG names U.S. government-sector organizations among those affected, without naming the level of government. For the CrowdStrike stream it is an independent check on CrowdStrike's framing: it agrees that ARTEX is used in real intrusions and moves fast, but stresses that the activity is noisy and detectable, which tempers vendor messaging that only machine-speed defense can keep up.
- Evidence and measured results
- Incident-response observations and research telemetry from Google/Mandiant, a CrowdStrike competitor. Independent of CrowdStrike, but not peer reviewed; victims are not named, case counts are not given, and the report does not assess VAPOR PANDA or test any CrowdStrike claim directly.
- Limitations and uncertainty
- Vendor research by a CrowdStrike competitor; no victim names, case counts or rate of success. The report does not mention CrowdStrike, so it corroborates the threat class, not CrowdStrike's attribution or figures. Published Oct 30, before the last run, and carried today because it was missed then and remains current.
AhnLab ASEC: Tracking ARTEX Infrastructure — signs of real-world cyberattacks
ASEC examined two internet-exposed ARTEX working directories (37 and 14 files) containing an ASPX web shell, a reverse TCP relay, a Pass-the-Hash RDP attempt, internal scans of Kubernetes and private networks, a JVM heap-dump credential extractor and Rust and Go implants. It confirmed with high confidence that a Pass-the-Hash RDP connection was attempted, but could not determine whether access succeeded, credentials were taken or implants were deployed. It concludes that tool presence, execution, attack success and attribution must be assessed separately. Why now: it is an independent view of the ARTEX activity at the center of CrowdStrike's current reporting, and it gives a method for reading the different compromise figures in circulation.
Why it matters, evidence and limitations
- Why it matters
- Indirect: no SLED victims are named. Its value for public-sector buyers is methodological. It shows how to separate attempted from confirmed intrusion, which is the distinction state and university leaders need when they read vendor counts such as CrowdStrike's 200+ VAPOR PANDA targets versus nine confirmed post-exploitation cases.
- Evidence and measured results
- Forensic review of exposed attacker files by a security vendor independent of CrowdStrike. It does not mention CrowdStrike or VAPOR PANDA, names no victims and states that it cannot confirm success or attribution.
- Limitations and uncertainty
- Evidence is limited to two working directories; ASEC could not confirm success, exfiltration or operator identity. It does not test or mention CrowdStrike's findings. Published Oct 30, before the last run, and carried today because it was missed then and bears on current reporting.
How to read this edition
Source findings, measured results and limitations come from the cited publications. Patterns, operating questions, role takeaways and implementation considerations are Lighthouse Advisory interpretation, stated as questions to validate locally rather than guaranteed outcomes. Vendor and operator claims are labeled as claims. Full research method.
- Independent research
- Research conducted outside the implementing organization.