CrowdStrike says the China-linked hacking group it tracks as VAPOR PANDA used an AI-driven intrusion framework to target more than 200 organizations across at least 14 countries in an 11-day campaign that began on October 17, 2026, making the VAPOR PANDA AI Agents operation one of the largest AI-powered espionage campaigns ever disclosed. The Hacker News reported that the group ran the Go-based ARTEX framework, powered mainly by the Chinese-developed DeepSeek large language model, to coordinate simultaneous intrusions at a speed and scale CrowdStrike had not previously observed.

CrowdStrike published its analysis on October 29. The group, previously tracked as VexatiousTemper and overlapping with a cluster Trend Micro calls Earth Estries, had been active since at least February 2021, but Unite.AI reported this was the first time CrowdStrike had seen the adversary use AI-driven intrusion tooling.

card vapor 1
VAPOR PANDA ran the ARTEX agentic framework against 200+ organizations in 14+ countries. Graphic: GPTOnline

Inside the ARTEX Operation

ARTEX is an open-source agentic AI framework that pairs a main agent with subordinate planner and worker agents sharing a graph of facts, findings and goals. SecurityBrief reported that VAPOR PANDA ran ARTEX primarily on DeepSeek, supplemented by a second subscription-based commercial large language model that CrowdStrike Intelligence could not identify.

A human operator stayed in the loop, directing the agents to write web shells, extract domain administrator passwords and enumerate endpoint sensor coverage. The scale of automation was striking: in a single intrusion, the adversary’s planning agents consumed on the order of 1.4 billion input tokens, a figure CrowdStrike said points to far higher consumption across the operation as a whole.

CrowdStrike’s OverWatch team observed the exploitation activity coming from a single ARTEX controller linked to VAPOR PANDA infrastructure. “Agentic tooling like ARTEX enables this scale of expansion at speed, allowing a small team to pursue a wider target set than manual operations would support, rather than a wholesale shift away from the adversary’s established access-development mission,” CrowdStrike said in its analysis.

Who Was Targeted

The target list reads like a diplomatic and industrial directory. The Hacker News detailed intrusions inside the foreign ministries of two Latin American countries, with a third likely breached, plus target files staged for ministries in Central America and Asia, and a Middle East-based interior ministry. One engagement zeroed in on a single European country, hitting its foreign ministry, presidency and prime minister’s office alongside defense, justice, finance and intelligence entities.

In the United States, the campaign reached 19 organizations across the pharmaceutical, semiconductor, defense, nuclear and financial sectors, plus telecommunications providers in the US, Belgium and the Philippines.

CrowdStrike confirmed post-exploitation activity at nine organizations, where the attackers deployed BLOODALCHEMY, a derivative of the ShadowPad backdoor, then moved into credential spraying, network scanning and reconnaissance. At least 12 more organizations, including US-based think tanks and European government entities, faced password-spraying and credential-scanning activity.

card vapor 2
A single intrusion burned about 1.4 billion input tokens. Graphic: GPTOnline

Why It Matters

“This campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator,” said Adam Meyers, CrowdStrike’s senior vice president of intelligence, according to CISO Voice. It is also a notable broadening of VAPOR PANDA’s targeting beyond its usual government, think tank and energy victims into pharmaceuticals, semiconductors, nuclear and defense.

CrowdStrike distinguished this campaign from separate ARTEX activity that Microsoft disclosed under the Storm-0940 designation, arguing the framework is “quickly gaining popularity among multiple China-nexus adversaries.” The company assessed that China-linked adversaries will “highly likely continue adopting agentic frameworks such as ARTEX over the next 12 months, pairing them with commercially available LLMs, and enabling small teams to quickly scale intrusions across many targets simultaneously.”

For defenders, the message is blunt: AI agents have moved from experimental to operational in state-sponsored espionage, and the teams wielding them are getting more done with fewer people.

Sources