Announced 29 Oct 2026 · Sources checked
The campaign
CrowdStrike OverWatch said on 29 October that it had identified a VAPOR PANDA campaign using the open-source ARTEX agent framework, run alongside the Chinese-developed DeepSeek large language model and a second, subscription-based commercial LLM, to conduct intrusions against multiple high-value targets in parallel. Beginning October 17, 2026, the adversary used ARTEX against more than 200 distinct organizations worldwide.
The target list reads like a who's who of sensitive sectors: foreign ministries in Latin America, Europe, Asia and the Middle East; semiconductor, defense and think tank organizations in the United States; pharmaceutical companies; nuclear-sector entities; and telecommunications providers in multiple regions. CrowdStrike described the campaign as an escalation in China-nexus use of AI agents — from single intrusions to multiple simultaneous engagements directed by a human operator.
How ARTEX works
ARTEX is an open-source penetration-testing framework, published on GitHub this year, that takes a goal from a human operator and chains reconnaissance, exploitation and lateral movement on its own, calling a language model to decide each next step. It coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals, advancing each engagement from initial access through host reconnaissance and lateral movement.
CrowdStrike recovered transcripts showing an operator issuing instructions in Chinese — marked with the label 'human instruction' and timestamped in China Standard Time — directing agents to write web shells, extract domain administrator passwords, and inventory endpoint sensor coverage. The framework was built to evade sensors: instructions included identifying hosts without the CrowdStrike Falcon sensor.
The scale
More than 200 organizations in 11 days works out to roughly 18 new targets a day from a single controller — a pace that would previously have required a sizable team of operators working in parallel. The confirmed intrusion rate (nine of 200-plus) is low, but the framework does not need a high success rate when the cost of each additional attempt is close to zero.
In one single intrusion, VAPOR PANDA's planning agents consumed on the order of 1.4 billion input tokens. The campaign's reliance on open source components layered on top of commercial LLM subscriptions shows how adversaries can assemble scalable, multi-agent intrusions largely from publicly available resources.
Confirmed victims
CrowdStrike Intelligence confirmed post-exploitation activity at nine organizations, where the adversary gained access, deployed the BLOODALCHEMY backdoor, and conducted credential spraying, network scanning and reconnaissance. The backdoor was loaded via a legitimate GameHook binary renamed svchost.exe, a malicious DLL and a decrypted payload file, staged in exposed open directories.
At least 12 additional organizations faced password-spraying and credential-scanning activity not counted as confirmed intrusions, including US think tanks and European government entities. Two of the compromised organizations were US pharmaceutical companies. CrowdStrike also identified BLOODALCHEMY infrastructure and C2 servers not present in earlier public ARTEX reporting.
Context and caveats
VAPOR PANDA has targeted government, think tank, energy and extractive organizations since 2021 — the ProxyLogon era — and this is its first observed use of AI-driven intrusion tooling, with a notable broadening into pharmaceutical, semiconductor, nuclear and defense targets.
The attribution is CrowdStrike's assessment; the firm saw the operation because the operator intermittently exposed its own tools, target files and agent transcripts — an operational security lapse that has become a recurring feature of AI-assisted intrusions. The same framework was reported on October 7 in a separate ARTEX case hitting South Korean financial institutions. DeepSeek has not publicly responded to the findings, and the Chinese government routinely denies involvement in cyberespionage.
Why AI changed the labor model
The key difference from earlier Chinese espionage is not the targets but the labor model. Previously, running this breadth of operations would have required a large team of operators working in parallel, each manually logging into separate systems and executing the same playbook. ARTEX replaces most of that with a graph of agents that plan, execute and report, with a human operator supervising the volume of work at key decision points.
That efficiency is exactly what makes the campaign hard to defend against and hard to attribute confidently in real time. Because the framework is open source and runs on a model that can be downloaded and run locally without provider oversight, the same playbook is available to non-state actors as well. CrowdStrike's October 7 report on an ARTEX operator breaching South Korean financial institutions for financial gain showed the same framework running without apparent state direction.
Defensive implications
For defenders, the campaign is a reminder that speed and breadth matter more than sophistication. The attacker's success rate was low — nine confirmed intrusions out of 200-plus — but at near-zero marginal cost per attempt, volume itself is the weapon. Organizations should assume that agent-driven credential spraying will continue even after the campaign is publicly disclosed.
The exposed open directories also highlight an insight for defenders: AI-assisted intrusions generate enormous amounts of intermediate artifacts — transcripts, target files, tooling — and attackers will occasionally misconfigure their infrastructure in ways that leak them. Monitoring for such leaks has already proven valuable: it is how CrowdStrike confirmed BLOODALCHEMY infrastructure and how the operator's Chinese-language instructions were recovered.
Common questions
What is ARTEX?
An open-source penetration-testing agent framework that chains reconnaissance, exploitation and lateral movement, calling an LLM to decide each next step.
How many organizations were attacked?
More than 200 across at least 14 countries in 11 days, with nine confirmed post-exploitation cases.
Which AI was used?
VAPOR PANDA ran ARTEX primarily on DeepSeek plus a second unidentified commercial LLM.
Sources & further reading
How this story was made
Written by Kristian Kostov with AI assistance and checked against the linked sources. Company performance claims are attributed to the company. Analysis reflects AiLookout’s interpretation; we have not independently tested the products discussed. The cover is an AI-generated editorial illustration, not a photograph or evidence of an actual event.
Our editorial standards
