CrowdStrike says China-nexus group VAPOR PANDA used ARTEX AI agents to target more than 200 organisations

CrowdStrike says its OverWatch team observed a campaign by the China-nexus adversary VAPOR PANDA that began on 17 October 2026. The group used ARTEX, an agentic intrusion framework, with the DeepSeek LLM and a second, unconfirmed commercial LLM against more than 200 organisations worldwide. Targets included foreign ministries, US pharmaceutical, semiconductor and defence firms, think tanks and telecoms providers.

According to CrowdStrike, it confirmed post-exploitation activity at nine organisations, and it describes BLOODALCHEMY backdoor deployments at a Middle East interior ministry and a Latin American foreign ministry. A human operator steered agents that ran several engagements in parallel. One intrusion consumed roughly 1.4 billion input tokens. Against a Greek government entity, the operator supplied the agent with a 2022 mail-server directory export containing authentication keys that had likely not been rotated since the export.

CrowdStrike recommends rotating keys held in historical backups and exports, enforcing SAML signature validation and IMDSv2, and hunting for ARTEX markers. It has also published indicators of compromise.

Editor’s note: This article relies on CrowdStrike’s own threat research and a law-firm blog summarising it; the findings have not been independently verified.