The Pulse
CrowdStrike Says VAPOR PANDA Used AI Agents Against 200 Targets
CrowdStrike says China-linked group VAPOR PANDA used the ARTEX AI-agent framework against more than 200 organizations in at least 14 countries. The company confirmed post-exploitation activity at nine organizations and says the agents ran p
AI.info Team · Written with AI · fact-checked ·
In one intrusion, VAPOR PANDA’s AI planning agents consumed about 1.4 billion input tokens. CrowdStrike says the China-linked group used the ARTEX framework against more than 200 organizations worldwide during an 11-day campaign that began October 17, 2026. Its report, published October 29, says the targets included government ministries, U.S. defense and semiconductor organizations, and telecommunications providers.
200 targets, nine confirmed intrusions
The figure of more than 200 describes organizations targeted, not confirmed compromises. CrowdStrike says it confirmed post-exploitation activity at nine organizations: there, the group gained access, deployed the BLOODALCHEMY backdoor, and conducted follow-on credential spraying, network scanning, and reconnaissance. It also observed password-spraying and credential-scanning against at least 12 additional organizations.
Activity reached entities in at least 14 countries. CrowdStrike says the group conducted extensive intrusions at foreign ministries in two Latin American countries and likely compromised a third; it also compromised a Middle East-based interior ministry. In one European country, targets included the foreign ministry, presidency, prime minister’s office, and defense, justice, finance, and intelligence entities.
A separate engagement targeted 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors. The group also compromised telecommunications providers in the United States, Belgium, and the Philippines.
ARTEX kept an operator in the loop
VAPOR PANDA ran ARTEX primarily with DeepSeek, a Chinese-origin large language model, and supplemented it with a subscription-based commercial model that CrowdStrike could not identify. ARTEX coordinates a main agent with planner and worker agents, which share findings and goals as they work through tasks from initial access to reconnaissance and lateral movement. CrowdStrike says a single intrusion’s planning agents used about 1.4 billion input tokens; the report does not give a total token count for the campaign.
The framework did not operate without human direction. Recovered transcripts show an operator issuing instructions in Chinese to write web shells, obtain domain administrator passwords, and check which hosts lacked the CrowdStrike Falcon sensor. CrowdStrike says the operator steered the agents at decision points while they handled multiple engagements in parallel.
Agents used familiar intrusion techniques
At one U.S. pharmaceutical organization, ARTEX agents chained an unsigned SAML assertion with an XML external entity flaw to reach a cloud metadata service and obtain credentials for a role able to issue administration commands to thousands of instances. The report says the agents then escalated to recover an enterprise administrator account. At a second pharmaceutical organization, they deployed web shells, obtained root access in a production container environment, and used stored administrator passwords and other techniques to impersonate a privileged account.
At a Greek government entity, the operator supplied a 2022 mail-server directory export containing authentication keys CrowdStrike says likely had not been rotated. The agents used those keys to forge an administrator token and read mailboxes, then used VPN details found in email to reach the internal network. In two government intrusions, the group deployed BLOODALCHEMY, a backdoor that CrowdStrike says was loaded using a legitimate program renamed to appear as svchost.exe.
CrowdStrike separates this from Storm-0940
CrowdStrike says this VAPOR PANDA operation is separate from ARTEX activity reported under the Storm-0940 designation. The distinction matters: the company’s report describes multiple China-nexus actors using the same agent framework, rather than treating the campaigns as one operation. It characterizes this as VAPOR PANDA’s first observed use of AI-driven intrusion tools and says the group’s targets now span additional sectors, including pharmaceuticals, semiconductors, nuclear, and defense.
The report also lists defensive steps, including rotating credentials after suspected exposure, enforcing SAML signature validation, and checking systems for ARTEX-related markers. CrowdStrike does not identify the second commercial model used in the campaign.