Vapor Panda Hackers Used AI Agents to Target 200+ Organizations
China-linked hacking group Vapor Panda used an AI agent framework called ARTEX to target more than 200 organizations in 14 countries over just 11 days, CrowdStrike said on October 29, 2026. The campaign, which began on October 17, ran mainly on China’s DeepSeek large language model plus a second commercial model, and CrowdStrike confirmed that at least nine organizations were breached.
What Vapor Panda Did With ARTEX
According to a CrowdStrike threat report, a single ARTEX controller linked to Vapor Panda ran several intrusion “tasks” at the same time. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East, as well as US semiconductor, defense, pharmaceutical, nuclear and financial companies, think tanks and telecom providers in the US, Belgium and the Philippines.
CrowdStrike says the group extensively breached the foreign ministries of two Latin American countries, compromised a Middle Eastern interior ministry, and in one European country went after the foreign ministry, presidency and prime minister’s office. At nine organizations, the attackers installed the BLOODALCHEMY backdoor, a tool first documented in 2023, and then moved on to credential spraying and network scanning. At least 12 more organizations faced password-spraying attempts. NBC News first reported the findings.
How the AI Agents Worked
ARTEX runs a main agent that hands work to planner and worker agents, which share a common map of findings and goals. A human operator stayed in the loop, typing instructions in Chinese at key decision points. In a single intrusion, the planning agents used about 1.4 billion input tokens, which shows how much of the work was automated.
The agents combined AI speed with familiar hacking techniques. At one US pharmaceutical company, an agent chained an unsigned SAML assertion with an XXE flaw to reach a cloud metadata service and eventually recover an enterprise admin account. Against a Greek government body, the operator fed the agent a 2022 mail server export with keys that had never been rotated, which let it forge an admin token and read mailboxes. The operator also told the agents to look for Windows machines that were not running CrowdStrike’s Falcon sensor.
Why the Vapor Panda Campaign Matters
CrowdStrike calls this an escalation: earlier cases showed AI agents helping with one intrusion at a time, while here one small team ran many attacks in parallel. It is also Vapor Panda’s first observed use of AI tooling. The campaign is separate from the ARTEX activity that Microsoft linked to Storm-0940 on October 21, which suggests the framework is spreading among several China-linked groups. CrowdStrike expects such groups to keep adopting agentic tools over the next 12 months.
The company advises organizations to rotate keys and credentials after any suspected data exposure, enforce SAML signature checks, require IMDSv2 on cloud instances, patch internet-facing appliances and run endpoint detection on every server.
The report lands as AI security worries grow on several fronts, from Anthropic’s warning about Chinese firms distilling Claude models to data concerns around Alibaba’s Qwen model. AI is also being used on defense: see how AI uncovered a critical PHP vulnerability and how Mistral pitched Large 4 for cyber defense.
Your comment has been submitted,
it will be published after approval.