Unfortunately, it looks like political BS is infecting threat reports now.
This morning a journalist asked my opinion on this attack campaign, referencing a Crowdstrike writeup: https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
The first paragraph already had my eyebrows comically high (emphasis mine):
CrowdStrike OverWatch identified a VAPOR PANDA campaign using ARTEX alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial LLM to conduct intrusions against multiple high-value targets in parallel.
Oh really? This is what we're doing now? We're making sure everyone knows DeepSeek is CHINESE DEVELOPED, but not even naming the US models used by the attacker? (Claude and Grok, by the way)
Zscaler's writeup is 1000% better in terms of listing all the actual facts, regardless of whether they might put the company's respective CEOs in an awkward situation at a dinner party with AI leaders at some point.
Both shamelessly push products in the recommendations section, but that's par for the course.
