Know what changed.
Trace why it matters.

CrowdStrike said China state-backed group Vapor Panda used the ARTEX automated agentic AI penetration-testing framework in a campaign that compromised about 140 sensitive targets in 11 days. Since Oct. 17, Vapor Panda targeted more than 200 organizations in at least 14 countries, including foreign ministries, senior government offices, defense and intelligence agencies, U.S. organizations in several sensitive sectors, and telecom providers.

CrowdStrike reported that ARTEX, paired with DeepSeek, enabled requests as often as every 10 seconds and concurrent pursuit of multiple attack paths.

The n0n ransomware operator targeted 23 organizations across 14 countries; investigators found no evidence that any documented compromise used vulnerability exploitation, while every documented entry relied on weak or stolen credentials. Reported entry methods included widespread RDP scanning, automated FortiGate SSL-VPN credential stuffing, exposed cloud credentials, and reused hosting-portal sessions.

Impacts varied by target and included data theft, encryption, deletion of data and backups, and network disruption; the source says deletion and backup destruction can leave recovery problems that decryption alone cannot solve.

Binance reported a security incident involving approximately $6.3 billion in cryptocurrency; Binance.US was not affected. Binance’s initial investigation identified a compromised DevOps engineer’s laptop as a possible entry point, with attackers accessing a service container and submitting unauthorized withdrawal transactions.

TRM Labs estimated that about $6.36 billion left Binance wallets across ten blockchains, with most transfers occurring within approximately 20 minutes.