Vapor Panda used ARTEX AI agents against more than 200 organizations
CrowdStrike attributes an AI-assisted espionage campaign to Vapor Panda, reporting more than 200 targets and confirmed activity after compromise at nine organizations. ARTEX coordinated planning and worker agents under human direction, with DeepSeek as a principal model. Foreign ministries, telecommunications companies and US strategic industries were among the targets; the targeting total is broader than the confirmed intrusion count.
Artificial Intelligence··Night
The campaign targeted ministries and strategic industries
Cybersecurity company CrowdStrike attributes an AI-assisted espionage campaign to Vapor Panda, a China-based threat group. Reporting on its investigation, The Hacker News says the activity began on October 17 and targeted more than 200 organizations worldwide. Foreign ministries in several regions, telecommunications providers and US organizations in strategic industries were among the targets. Oktsec’s review of the same campaign also reports the targeting scale and attributes the underlying investigation to CrowdStrike. It explicitly describes its account as a review of those findings rather than an independent examination of victim computers.[1], [2]
ARTEX coordinated agents under human direction
The operation used ARTEX, a framework for coordinating AI planning and worker agents. DeepSeek was a principal model, while another subscription-based commercial model has not been identified. Human operators supplied objectives and redirected the software’s work. CrowdStrike describes agents pursuing different paths and switching approach when one failed. The reported role for AI extends to coordinating activity across multiple targets, with people continuing to steer the operation. The accounts describe this campaign’s use of the framework; they do not identify every user of ARTEX with the same group or establish that the software acted without human involvement.[1], [2]
The targets spanned government and commercial institutions. The Hacker News names foreign ministries in Latin America, Europe, Asia and the Middle East, alongside US organizations in pharmaceutical, semiconductor, defense, nuclear and financial sectors. Telecommunications providers in the US, Belgium and the Philippines also appear in the reported target set. CrowdStrike’s interpretation is that the agent-based tooling allowed a small team to pursue more organizations at once while continuing its existing mission of developing access to valuable systems.[1]
Nine organizations had confirmed activity after compromise
CrowdStrike confirmed activity after compromise at nine organizations. The broader figure of more than 200 refers to targets, so it cannot be read as a total of successful intrusions. The Hacker News reports the deployment of the BLOODALCHEMY backdoor in the confirmed activity, followed by additional reconnaissance. Oktsec keeps this case separate from another campaign involving Argentine healthcare organizations, and says CrowdStrike also distinguishes it from ARTEX activity attributed to Storm-0940. Those boundaries matter to the reported victim count: findings from the separate operations are not part of this campaign’s confirmed nine organizations.[1], [2]
