CrowdStrike says a China-linked hacking group used an AI agent framework to run intrusions against more than 200 organizations in at least 14 countries over 11 days, with a single operator steering several attacks at once. The group, which CrowdStrike tracks as VAPOR PANDA, used the ARTEX framework from October 17, 2026, and CrowdStrike confirmed post-exploitation activity at nine organizations. The campaign marks a shift from agents assisting a single intrusion to agents carrying out many intrusions in parallel, under human direction at key decision points.
One controller, many targets
CrowdStrike’s OverWatch team observed exploitation activity coming from a single ARTEX controller, which CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. The controller periodically exposed adversary tooling, target files and agent transcripts, giving investigators an unusually clear view of how the operation worked.
Within the framework, each engagement is called a task, and several tasks ran against different targets at the same time. The targeting was broad and high value, spanning governments, industry and telecoms providers across several regions. That parallelism is the operation’s defining feature.
VAPOR PANDA ran extensive intrusions inside the foreign ministries of two Latin America-based countries, likely breached a third, and staged target files for use against foreign ministries in Central America and Asia. It also compromised a Middle East-based interior ministry.
One engagement focused on a single European country, covering its foreign ministry, presidency and prime minister’s office, plus defence, justice, finance and intelligence entities. A separate engagement targeted 19 United States-based organizations across pharmaceutical, semiconductor, defence, nuclear and financial sectors.
Telecommunications providers in the United States, Belgium and the Philippines were also compromised, widening the operation’s reach into communications infrastructure. At the nine organizations with confirmed post-exploitation activity, the attackers gained access, deployed the BLOODALCHEMY backdoor, and moved into credential spraying, network scanning and reconnaissance.
At least 12 more organizations faced password-spraying and credential-scanning attempts, which CrowdStrike counts separately from confirmed breaches. That distinction matters: the campaign reached more than 200 organizations, but confirmed deeper access at nine of them. The wider targeting figure still shows the operation’s ambition.
How ARTEX worked
ARTEX pairs a main agent with subordinate planner and worker agents that share a graph of facts, findings and goals, moving each engagement from initial access through host reconnaissance to lateral movement. The framework has appeared in earlier AI-assisted campaigns, but CrowdStrike says this is the first time a targeted adversary has used it for parallel attacks.
The framework ran primarily on the Chinese-developed DeepSeek language model, supplemented by a second subscription-based commercial model that CrowdStrike could not identify. In a single intrusion, planning agents consumed roughly 1.4 billion input tokens, a figure CrowdStrike says points to far higher consumption across the whole operation.
The human operator stayed in the loop. Recovered transcripts showed instructions in Chinese, marked with a label translated as human instruction and timestamped in China Standard Time, directing agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage.
At a global pharmaceutical organization, the operator told the agents to find Windows machines in the domain without Falcon, using Chinese red-team slang for the CrowdStrike Falcon sensor. That let follow-on activity concentrate on unprotected hosts, with sensor evasion built directly into the agentic workflow.
The agents paired automation with established tradecraft rather than relying on novel exploits alone. At one United States pharmaceutical organization, an agent chained an unsigned SAML assertion with an XML external entity flaw to reach the cloud Instance Metadata Service.
That chain gained a role able to issue administration commands to thousands of instances, before the agent recovered an enterprise administrator account. At a second pharmaceutical organization, agents planted web shells, abused an unauthenticated orchestration service to gain root access in a production container environment, and read administrator passwords.
At a Greek government entity, the operator supplied the agent with a 2022 directory export from the organization’s mail server holding authentication keys that had likely never been rotated. The agent forged an administrator token, read mailboxes, and reached the internal network through VPN configurations taken from a user’s sent mail.
Why It Matters
The campaign matters because it changes the economics of espionage. Previously, CrowdStrike had seen threat actors use AI agents to assist individual intrusions, whereas VAPOR PANDA used them to run several engagements at once, intervening only to steer agents at decision points.
A small team can now pursue a wider target set than manual operations would support, and a single intrusion can seed many more. Defenders must assume that a single exposed credential or unpatched appliance can be exploited across many targets simultaneously, rather than in one slow intrusion.
The findings also sharpen the debate about agent safety in general. The same week brought reports of a personal agent running undetected on a Pentagon network, a reminder that agents with broad permissions create risk whether they are deployed by an attacker or a legitimate user.
CrowdStrike’s recommendations are deliberately unglamorous: rotate keys found in old backups and exports, enforce SAML signature validation, require IMDSv2, patch internet-facing appliances and deploy endpoint detection on servers assumed unreachable. Those basics, applied before agents arrive, are now the difference between a contained incident and a campaign.
Background
CrowdStrike published its VAPOR PANDA analysis on October 29, 2026, and says the campaign is separate from ARTEX activity reported by industry sources under the Storm-0940 designation. Since 2021, VAPOR PANDA has mostly targeted government, think tank, energy and extractive organizations, and this is its first observed use of AI-driven intrusion tooling.
Source: CrowdStrike report and Unite.AI coverage
0 Comments