Vapor Panda Aimed AI Agents at 200+ Targets

A China-based espionage group used an AI agent framework called ARTEX to go after more than 200 organizations in at least 14 countries over 11 days, CrowdStrike said in a report published Oct. 29. The security company attributes the campaign to the group it tracks as VAPOR PANDA and says the agents ran primarily on a model from Chinese AI developer DeepSeek.

Key takeaways

• CrowdStrike says one ARTEX controller targeted 200+ organizations in 14+ countries, starting Oct. 17, 2026.
• Post-exploitation activity was confirmed at nine organizations; at least 12 more faced password spraying or credential scanning.
• It is the first time CrowdStrike has seen VAPOR PANDA use AI-driven intrusion tooling, and the company expects more China-nexus groups to follow within 12 months.

What CrowdStrike found in the VAPOR PANDA ARTEX campaign

CrowdStrike's threat-hunting unit, OverWatch, spotted the exploitation coming from a single ARTEX controller, and CrowdStrike Intelligence tied that controller to VAPOR PANDA infrastructure. The company has tracked the group since February 2021 and describes it as state-sponsored, focused on intelligence gathering and intellectual property theft.

Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, along with U.S. semiconductor, defense and think tank organizations and telecommunications providers. One engagement alone hit 19 U.S. organizations in the pharmaceutical, semiconductor, defense, nuclear and financial sectors.

CrowdStrike said telecom providers were compromised in the United States, Belgium and the Philippines, and a Middle East interior ministry was also breached. At that ministry and at a Latin American foreign ministry, the attackers deployed BLOODALCHEMY, a backdoor first publicly documented in October 2023.

How ARTEX AI agents run an intrusion

ARTEX uses a main agent that coordinates subordinate planner and worker agents over a shared graph of facts, findings and goals. Each engagement, which the framework calls a "task," moves from initial access through host reconnaissance to lateral movement.

The campaign ran ARTEX mainly on DeepSeek's model, supplemented by a subscription-based commercial model that CrowdStrike could not identify. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens.

The operation was not fully autonomous. A human operator intervened at decision points, and recovered transcripts contained Chinese-language instructions. In one case, the operator told the agents to "find Windows machines in the domain without Falcon," CrowdStrike's own endpoint sensor.

Cloud attack technique: SAML and instance metadata

In one cloud environment, the agents chained an unsigned SAML assertion with an XML external entity (XXE) flaw to query the instance metadata service. That yielded a role able to issue commands to thousands of instances, which led to an enterprise administrator account.

Context: the second ARTEX campaign in weeks

ARTEX has surfaced before. On Oct. 21, Microsoft said a China-aligned actor it calls Storm-0940 used the open-source framework to attempt sign-ins to more than 2,250 customer tenants after a ConnectWise supply chain compromise. CrowdStrike says the VAPOR PANDA activity is separate from that campaign and that ARTEX lets small teams pursue more targets at once.

What's next for defenders

CrowdStrike says it is "highly likely" China-nexus adversaries will keep adopting agentic frameworks like ARTEX over the next 12 months. It recommends rotating signing keys and service credentials after suspected exposure, including those in old backups and directory exports; enforcing SAML signature validation; requiring IMDSv2; and limiting cloud role permissions.

The company also published hunting markers, including "artx" or "artex" in command-line parameters, artx-prefixed cloud roles and the C:\ProgramData\artx5v\ directory, and urged patching internet-facing appliances and deploying endpoint detection on every server.

FAQ

Were all 200-plus organizations breached?

No. More than 200 organizations were targeted. CrowdStrike confirmed post-exploitation activity at nine and password spraying or credential scanning at at least 12 others.

Did DeepSeek's model act on its own?

No. CrowdStrike says a human operator stayed in the loop and stepped in at decision points, while the agents handled planning and execution.

Is this the same as Microsoft's Storm-0940 report?

No. Both campaigns used ARTEX, but CrowdStrike describes the VAPOR PANDA activity as separate from what Microsoft reported.

References

• VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign — CrowdStrike (Oct. 29, 2026)
• Vapor Panda — CrowdStrike Adversary Universe
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise — Microsoft Security Blog (Oct. 21, 2026)