A controller used to run espionage operations intermittently exposed its own working files, giving CrowdStrike researchers an unusual view of the instructions a human operator passed to AI agents. The company attributed the activity to a group it calls VAPOR PANDA. Over eleven days beginning October 17, it observed targeting across at least 14 countries through that single controller.
The researchers counted more than 200 organizations targeted and found evidence of activity after entry at nine. They also saw attempts to discover or guess credentials at a further dozen or more. The records included targets in the pharmaceutical and semiconductor industries as well as government and telecommunications. The figure of 200 describes the reach of the operation. Only a portion of those targets had confirmed intrusions.
One assignment involved a Greek government organization. According to CrowdStrike, the operator supplied keys from a mail server directory exported in 2022. An agent used them to produce an administrator token and read mailboxes. Information in sent mail helped extend access to the internal network. In other recovered instructions, a human directed agents to identify machines without a particular endpoint security sensor.
NAOAT analysis
The four-year-old export explains something the target count alone cannot. A person brought knowledge from an earlier exposure into a fresh operation, and the software could work through the consequences while other assignments continued. An investigation confined to the date on which the agent first appeared would miss the older decision that still mattered. An authentication key had retained its authority across years of changes to the surrounding system.