A China-nexus hacking group that CrowdStrike (Nasdaq: CRWD) calls VAPOR PANDA aimed ARTEX, an AI agent framework, at more than 200 organizations in at least 14 countries over 11 days from October 17, 2026, the security company said in a report published October 29. CrowdStrike confirmed post-exploitation activity at nine of them.
The group ran ARTEX mainly on DeepSeek's large language model, plus a second, subscription-based commercial model that CrowdStrike said it could not identify. A human operator steered several intrusions at once, which CrowdStrike called "an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator."
Source: CrowdStrike's VAPOR PANDA report.
What CrowdStrike observed
CrowdStrike OverWatch, its threat-hunting team, traced the activity to a single ARTEX controller that CrowdStrike Intelligence linked to VAPOR PANDA infrastructure. The controller intermittently exposed the group's tooling, target files and agent transcripts.
ARTEX coordinates a main agent with planner and worker agents that share a graph of facts, findings and goals, according to the report. The transcripts show the operator giving instructions in Chinese, labeled "human instruction" and timestamped in China Standard Time, and stepping in only at decision points. The operator told the agents to write web shells, extract domain administrator passwords and take stock of which machines ran endpoint protection.
At a global pharmaceutical company, the operator told the agents to find Windows machines "without Falcon," CrowdStrike's own sensor, so that follow-on work went to unprotected hosts. At a Greek government entity, the agent used authentication keys from a 2022 export of the organization's mail server, keys that had likely not been rotated since, to forge an administrator token and read mailboxes.
The targets, as CrowdStrike listed them:
Foreign ministries of two Latin American countries, with extensive intrusions, and likely a third
A Middle East interior ministry, compromised
One European country's foreign ministry, presidency and prime minister's office, plus defense, justice, finance and intelligence bodies
19 U.S. organizations in pharmaceuticals, semiconductors, defense, nuclear and finance
Telecommunications providers in the U.S., Belgium and the Philippines, compromised
At the nine confirmed organizations, the group deployed BLOODALCHEMY, a backdoor first documented in October 2023, then sprayed credentials and scanned networks. The group also ran password spraying and credential scanning against at least 12 more organizations, including U.S. think tanks. In a single intrusion, the planning agents consumed "on the order of 1.4 billion input tokens," the report said.
Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, summarized the findings on X:
Post on X by @Adam_Cyber
Beginning on October 17, 2026, VAPOR PANDA used the ARTEX harness against more than 200 distinct organizations worldwide, including foreign ministries in Latin America, Europe, Asia, and the Middle East; semiconductor, defense, and think tank organizations in the U.S.; and telecommunications providers in multiple regions. This campaign detailed in the following blog post is separate from the ARTEX activity recently reported by Microsoft under the Storm-0940 designation. CrowdStrike has previously documented ARTEX and similar agentic frameworks in use by financially motivated and unattributed actors; in this campaign, a targeted intrusion adversary used ARTEX to run parallel intrusions against multiple high-value targets. This campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator. The operation also shows the adversary building endpoint sensor evasion directly into their agentic workflow, including instructions to identify hosts without the CrowdStrike Falcon sensor. https://www.crowdstrike.com/en-us/blog/vapor-panda-uses-artex-to-scale-global-campaign/
How big it is, by our count
The figures are CrowdStrike's; the arithmetic is ours. More than 200 targets in 11 days is about 18 organizations a day. Nine confirmed is at most 4.5% of the targets, and adding the 12 sprayed organizations gives at least 21, or no more than 10.5%. Targeted is not the same as breached, and the report keeps the two apart.
VAPOR PANDA is also at least the third ARTEX operation made public in 22 days, in the fourth report; Zscaler treats CrowdStrike's October 7 report and its own October 14 one as covering the same campaign. Microsoft calls ARTEX "an open-source penetration testing framework that can use any AI model." Zscaler says it was developed in China and released on GitHub by a developer called "Autumn-27".
Date | Reported by | What |
|---|---|---|
Oct. 7 | CrowdStrike | ARTEX servers and South Korean financial targets |
Oct. 14 | Zscaler | Korean financial firms; data on about 67,000 people taken |
Oct. 21 | Microsoft | Storm-0940, a China-state aligned actor; ConnectWise supply chain |
Oct. 29 | CrowdStrike | VAPOR PANDA; 200+ organizations |
Sources: Zscaler, October 21 (for CrowdStrike's October 7 report); Zscaler, October 14; Microsoft, October 21; CrowdStrike.
CrowdStrike said its campaign is separate from Storm-0940's, "likely indicating the AI-based framework is quickly gaining popularity among multiple China-nexus adversaries."
What security researchers are saying
Researchers tracking ARTEX were posting about it on October 29, writing about the framework in general rather than about CrowdStrike's report. Florian Roth, head of research at Nextron Systems, wrote on X that AI attack frameworks matter more than the AI-found vulnerabilities drawing the headlines:
Post on X by @cyb3rops
Two posts today. The one about an 11-year-old Linux kernel vulnerability got far more attention than the one about CAIRN/ARTEX. I think the second topic is far more important. I’ve been following vulnerabilities long enough to recognize the pattern. They’re discovered, exploited, patched, and replaced by the next ones. AI will accelerate this process dramatically, but the fundamental cycle remains the same. What we’re seeing with AI-driven attack frameworks is something different. They’re starting to change how attacks are conducted in general, not just how vulnerabilities are discovered or exploited. They allow attackers to plan, adapt, make decisions, and scale entire operations with far less human effort. And vulnerability exploitation is just a small part of what these systems can do. I think this will have a much more profound and lasting impact on cybersecurity than the current wave of AI-discovered vulnerabilities. Yet the individual CVE gets all the attention. Linux kernel vulnerability: https://t.co/YCrlvpmEqu CAIRN/ARTEX: https://t.co/NV1VlZatLY
Michael Koczwara, a threat researcher and the founder of Intel Ops, wrote on X that he has observed more ARTEX servers than Cobalt Strike and all other command-and-control frameworks combined. His count of almost 2,200 is his own, and SaasBuzz could not check it.
Post on X by @MichalKoczwara
I have observed more ARTEX servers than Cobalt Strike and all other C2 frameworks combined. I have also seen new/not publicly detected AI-generated C2 frameworks already being used by threat actors. Almost 2,200 servers are running ARTEX, and that only counts those with exposed default admin panels. There are many more instances where the admin panel is hidden, disabled or modified.
What CrowdStrike tells defenders to do
Rotate signing keys, preauthentication keys and service credentials after any suspected data exposure, including keys in old backups and directory exports.
Enforce SAML signature validation, require IMDSv2 on cloud instances, and keep cloud roles' command-execution rights to the minimum.
Hunt for ARTEX markers: command lines containing "artx" or "artex", artx-prefixed cloud roles, and a C:\ProgramData\artx5v\ directory.
Patch internet-facing appliances, especially long-lived Linux servers.
Run real-time endpoint detection and response, such as its own Falcon sensor.
What it means for software teams
CrowdStrike's report names no CVE; it describes "well-established tradecraft" such as an unsigned SAML assertion, an XML external entity flaw and unrotated keys. The Greek intrusion ran on keys from a 2022 export, and the first item in CrowdStrike's advice is to rotate credentials. What the agents changed is the cost of trying: an operator worked many targets in parallel, so a forgotten key is more likely to be found.
That puts weight on hygiene a team can measure: the age of its oldest signing key, the hosts without endpoint coverage, and the secrets left in old backups. The Falcon instruction shows an attacker already sorting hosts by protection, so a coverage gap works as a target list, not only a compliance finding.
CrowdStrike expects more of the same. China-nexus groups "will highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months," it wrote, "… enabling small teams to quickly scale intrusions across many targets simultaneously." DeepSeek and China's government had not commented publicly on the report as of 9:45 a.m. ET on October 30.
