CrowdStrike says China-nexus VAPOR PANDA used AI agents to target more than 200 organizations
The ARTEX framework, run mainly on DeepSeek, led to confirmed post-exploitation at nine organizations in at least 14 countries.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
CrowdStrike says a China-nexus adversary it tracks as VAPOR PANDA used an AI-driven intrusion framework called ARTEX to target more than 200 organizations in at least 14 countries. The campaign ran over an 11-day window that began on October 17, 2026. According to Unite.AI's account of the October 29 report, ARTEX ran mainly on the Chinese-developed DeepSeek large language model and a second commercial model. CrowdStrike OverWatch saw the exploitation activity coming from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. From time to time, the controller exposed the attackers' tooling, target files and agent transcripts. These pointed to several engagements, called tasks within the framework, running against several targets at once. CrowdStrike confirmed post-exploitation activity at nine organizations. In those cases, the attackers gained access, deployed the BLOODALCHEMY backdoor, and moved on to credential spraying, network scanning and reconnaissance. Password-spraying and credential-scanning activity also hit at least 12 more organizations, including US think tanks and government bodies in Europe. The findings matter because they describe a state-linked group running AI agents against many targets at once while relying on commercially available models.