China-affiliated threat actors are capable of exploiting critical vulnerabilities within 24 hours of public disclosure, according to new findings from CrowdStrike.
The China-nexus groups Vault Panda and Genesis Panda were observed conducting rapid, systematic attacks that targeted the React2Shell exploit – a critical web application vulnerability that enables unauthenticated remote code execution in React Server Components and Next.js applications.
The flaw was disclosed in December 2025, with patches released in concurrence.
While multiple threat actors leveraged React2Shell in the wild, Vault Panda (UNC6588) and Genesis Panda (REF0657, Earth Lamia) were particularly fast in deploying various malicious tools against victims, including remote access trojans (RATs). These were used to conduct a range of post-exploit activities such as harvesting credentials.
“The speed of this response highlights their posture as adversaries who actively monitor vulnerability disclosures, rapidly validate exploitability, and pre-stage tooling in anticipation of a constantly changing attack surface,” the researchers noted in the CrowdStrike 2026 Threat Hunting Report, published on August 3.
AI Speeds up Vulnerability Exploitation
Overall, CrowdStrike observed that in 88% of publicly disclosed vulnerability exploits in H1 2026 the intrusion occurred within 48 hours of release. The firm also recorded a 42% year-over-year increase in zero day exploitation from 2024 to 2025.
The researchers noted that these patterns predate the integration of frontier AI into vulnerability research, therefore further compression of the timeline between disclosure and active exploitation should be expected in the coming months.
This follows the launch of AI tools like Anthropic’s Mythos and OpenAI’s GPT-5.4-Cyber and GPT-5.5-Cyber which have been designed to find and fix cybersecurity vulnerabilities at scale.
“Frontier models are likely contributing to the rising volume of disclosed vulnerabilities, exacerbating the challenges faced by network defenders as they attempt to cope with ever-shrinking patch windows,” the researchers added.
Identity Attacks Continue to Rise
The CrowdStrike report also highlighted a dramatic rise in identity-based attacks, largely linked to the use of AI.
This includes a growing trend of threat actors seeking to compromise victims’ own AI platforms via LLMJacking. This is at technique where financially motivated adversaries seek to obtain access to victims’ corporate LLM API access and sabotage the victim’s AI services beyond normal operating capacity to cause financial harm.
In one campaign, a threat actor sent nearly 200,000 API requests during a two-minute period after gaining elevated access to a cloud computing service offering access to foundation models.
CrowdStrike also detected a doubling in the number of intrusions involving vishing as the initial access vector in H1 2026 compared to H1 2025.
Vishing involves the impersonation of individuals via phone calls to bypass authentication requirements. These attacks have been enhanced by the use of AI tools, such as deepfakes.
The report noted that vishing has emerged as a key technique for e-crime actors as detection is difficult, with few markers of malicious activity available for defenders.
