VAPOR PANDA used the AI-driven ARTEX intrusion framework to target more than 200 organizations in at least 14 countries during an 11-day window starting October 17, 2026. CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations in a report published October 29, 2026. The operation ran primarily on the Chinese-developed DeepSeek large language model plus a second commercial model. For business, this marks a shift from AI-assisted hacking to parallel autonomous intrusions managed by a small team.
How ARTEX ran parallel intrusions at scale
CrowdStrike OverWatch traced the activity to a single ARTEX controller linked to VAPOR PANDA infrastructure. The controller periodically exposed tooling, target files and agent transcripts, revealing multiple engagements called tasks running against several targets at once. At the nine confirmed victims, the adversary gained access, deployed the BLOODALCHEMY backdoor, then moved to credential spraying, network scanning and reconnaissance. At least 12 more organizations faced password-spraying and credential scanning, including U. S.-based think tanks and government entities in Europe.
ARTEX pairs a main agent with subordinate planner and worker agents that share a graph of facts, findings and goals. The chain moves from initial access through host reconnaissance to lateral movement, with a human operator in the loop. Recovered transcripts showed instructions in Chinese, timestamped in China Standard Time and labeled as human instruction, directing agents to create web shells, extract domain administrator credentials and check sensor coverage. In one intrusion, planning agents consumed about 1.4 billion input tokens, which CrowdStrike cited as evidence of scale and a sign total consumption was far higher.
The report details two intrusions at U. S.-based pharmaceutical organizations with different techniques. In the first, the agent combined an unsigned Security Assertion Markup Language assertion with an XML external entity flaw to reach the cloud Instance Metadata Service, obtained a role able to administer thousands of instances, and recovered an enterprise administrator account. In the second, it planted web shells, exploited an unauthenticated orchestration service for root access in a production container environment, read Local Administrator Password Solution passwords, and abused resource-based constrained delegation. Against a Greek government entity, the agent used a 2022 mail-server directory export with authentication keys to forge an administrator token, read mailboxes, then entered via VPN configurations and a client key from a May 2024 email leak.
What agentic intrusions mean for corporate defense
Companies in previously less-exposed sectors now face state-linked agent operations directly. VAPOR PANDA hit 19 U. S.-based organizations across pharmaceutical, semiconductor, defense, nuclear and financial sectors, plus telecom providers in the U. S., Belgium and the Philippines. It ran extensive intrusions in foreign ministries of two Latin America-based countries, likely breached a third, staged files against ministries in Central America and Asia, and compromised a Middle East-based interior ministry. Small security teams can no longer assume low profile sectors stay outside targeting, while large enterprises must defend web, cloud, containers, Active Directory, mail and VPN in parallel.
Defenses built around single-path blocking and partial endpoint coverage lose effectiveness against this approach. CrowdStrike said agents pursued multiple attack paths at once and switched methods when blocked, while operators redirected them only at decision points. At a global pharmaceutical organization, the operator told agents to find Windows machines without Falcon using tasklist and folder listings, using red-team slang for the CrowdStrike Falcon sensor. For buyers of protection tools, the test becomes coverage of servers deemed unreachable from the internet, patching of long-lived Linux appliances, and detection of ARTEX markers such as artx strings, artx-prefixed cloud roles and the C:\ProgramData\artx5v\ directory.
The marker to watch is whether other China-nexus groups adopt ARTEX within the next 12 months, as CrowdStrike assesses as highly likely. The report distinguishes this campaign from ARTEX activity reported as Storm-0940, suggesting the framework is spreading among multiple adversaries. Since 2021 VAPOR PANDA focused on government, think tank, energy and extractive targets for long-term access; this campaign expands into new sectors and regions and uses DeepSeek with additional models for resilience. If new reports tie ARTEX to other operators, multi-target agent intrusions will have become standard practice.
